There is a qualitative difference between an internally discovered vulnerability - presumably by somebody with lots of access, knowledge, and the ability to ver

There is a qualitative difference between an internally discovered vulnerability - presumably by somebody with lots of access, knowledge, and the ability to verify their hypotheses - and an externally discovered vulnerability. Furthermore, if every potential vulnerability that might have been exploited needs to be reported as a breach... then each and every bug in any library and other dependency you use likely needs a breach report too - after all, you typically cannot verify retrospectively whether that exploit wasn't independently discovered and abused before the fix. I'm not even positive such a reporting requirement would really be a bad idea, but it would definitely needs some more mature reporting and population education to tell the two classes of issue apart, especially since it's pretty vague where you draw the line on what needs publication once you get that far.