Sorry I deleted my comment just as you posted. Thanks for the explanation. Here is the deleted comment: How does a vendor go from said SHA-1 hash to what the

Sorry I deleted my comment just as you posted. Thanks for the explanation. Here is the deleted comment: How does a vendor go from said SHA-1 hash to what the vulnerability is? I saw this as a rough draft for a way to easily publish vulnerabilities without letting the public view them but still letting the vendor have all the information.