@spacerog I agree with your point in general. It's odd that you're using a Microsoft case as the example. Microsoft was among the first companies to push for not calling it "Responsible Disclosure" for exactly the reason you point out. https://www.microsoft.com/en-us/msrc/blog/2010/07/coordinated-vulnerability-disclosure-bringing-balance-to-the-force For this specific case, who knows where the difference of opinion was - the github is super low on details.