Basically I found a vulnerability by complete accident that gave me access to people's PII in an IRS authorized e-file app.

I disclosed the vulnerability to them, and they ignored me.

What's next? I haven't found a way to report this to the IRS directly; everything seems focused on personal exposure. I want to make sure this gets addressed.

Anyone have any similar experience or advice?

Don't bother asking where or how; I won't be providing that information.