RE: Making the vulnerability reporting process more visible