The people that I know that works in security research treat responsible disclosure as "you have X time to fix it before we tell the world", to give them a chan

The people that I know that works in security research treat responsible disclosure as "you have X time to fix it before we tell the world", to give them a chance to fix things before everyone, with who knows what intent, gets to learn about the issue. There's always a time limit and then its released regardless.