The security research community would run you out on a rail if you tried to take a successful research product and attach mandatory disclosure norms to it.