Vulnerability reports and disclosures