Given (1) the blog post, (2) the author posted the blog link on HN, I assumed that the bugs would have reported upstream. If it were a blog describing a 0-day

Given (1) the blog post, (2) the author posted the blog link on HN, I assumed that the bugs would have reported upstream. If it were a blog describing a 0-day vulnerability in a given software, I wouldn't have assumed that it would have been reported.