All vulnerabilities should be disclosed immediately, publically. That would over a short time lead to much better security practices.