with vendor bugs publishing after a timer runs out is a good idea. an alternative is full disclosure, which is where you publish right away. another idea is to

with vendor bugs publishing after a timer runs out is a good idea. an alternative is full disclosure, which is where you publish right away. another idea is to keep the bug to yourself and use it as part of a product or service or learning experience, another option is to trade the bug with others, or sell it, or just do nothing. whole range of options, researchers usually find what they prefer and how they prefer to do it organically and opinions (broadly) tend to shift the longer you have been in the field.