Of course. From my understanding of research at public institutions there is a long period of time and steps between finding something interesting and submitti

Of course. From my understanding of research at public institutions there is a long period of time and steps between finding something interesting and submitting a paper for review. Why not disclose the vulnerability first to concerned parties and then write up a fancy research paper? Why the other way round? Only two explanations I could come up with: Either there must be a very short time frame between identification of the vulnerability and writing of the paper or there was further research needed. Or....I don't know