Would you agree that the following series of actions is the most ethical way of reporting a vulnerability? 1. Inform the company of the vulnerability 2. Offer

Would you agree that the following series of actions is the most ethical way of reporting a vulnerability? 1. Inform the company of the vulnerability 2. Offer a limited disclosure of the vulnerability to the public/whomever you want, without giving away details of the vulnerability, as these would make an attack from an adversary more possible while the company fixes the bug. 3. After the company patches the bug, do whatever you want. edit: I guess it would be important to ask this as well so we're not just going in circles, of the three general categories of ethical systems, would you say you prescribe to virtue, consequentialist, or deontological ethics?