I do see your point, but I still think a standardised way to at least make sure the vendor is aware of the issue would be needed if we're talking about a formal

I do see your point, but I still think a standardised way to at least make sure the vendor is aware of the issue would be needed if we're talking about a formal program. Not necessarily holding off publishing to do so though. But I don't mean to back the side of vendors unduly here...