Why do you place a higher priority on maintaining coordinated vulnerability disclosure than of the safety of actual users of the software being protected?