Vulnerabilities are typically fixed, and then reported.