Why are some vulnerabilities disclosed responsibly while others are not