Disclosure of a vulnerability doesnt mean a bad guy found it.