It used to be that wontfix / low impact stuff would still be publically disclosed. Responsible disclosure was the key principle. There shouldn't be a gap betw

It used to be that wontfix / low impact stuff would still be publically disclosed. Responsible disclosure was the key principle. There shouldn't be a gap between "won't fix" and "Too bad to be made public". If a company is happy not to fix something, they shouldn't complain if it's published.