When to disclose a zero-day vulnerability
the-parallax.com