Couldn't the product itself disclose to the vendors?
No firm in the world would use a vulnerability research product that automatically disclosed to vendors.
alt Hacker News
No firm in the world would use a vulnerability research product that automatically disclosed to vendors.