But the "process" is still "secret", and the whole issue is the shadow around this, gov agencies or corps, same same. At the time I was seeing "computer securit

But the "process" is still "secret", and the whole issue is the shadow around this, gov agencies or corps, same same. At the time I was seeing "computer security" people: namely at the time I did learn deliverable "security" is a fantasy, some said they were "pressured" by some corps to shut up with significant help from the authorities. There is only one way to do that safely: immediat full public disclosure. Corps and govs have to be ready for that all the time, this is a significant part of their job. The real issue is the trust about the source of "vulnerabilities", because upon publication, it must be validaded by competent ppl, and here we go again in the shadows where things could become "delayed" indefinitely (I guess as long as possible).