One of the things i admire about you is your rigor.
Im sure youd agree on first principles: best practice is to withhold disclosure until the harm is mitigated with patches. That does not change beca...
https://opensats.org/apply/red
"Report material vulnerabilities privately to the appropriate maintainer, vendor, or operator, and allow a reasonable opportunity to investigate and remediate before public disclosure. Do not exploit a vulnerability for unauthorized access or gain, condition disclosure on payment, or sell, transfer, or provide nonpublic findings to anyone who may misuse them. Failure to meet these conditions may result in rejection of your application or suspension or termination of funding, and repayment where the applicable grant terms provide for it."
"Report material vulnerabilities privately to the appropriate maintainer, vendor, or operator, and allow a reasonable opportunity to investigate and remediate before public disclosure. Do not exploit a vulnerability for unauthorized access or gain, condition disclosure on payment, or sell, transfer, or provide nonpublic findings to anyone who may misuse them. Failure to meet these conditions may result in rejection of your application or suspension or termination of funding, and repayment where the applicable grant terms provide for it."
1