Very publicly so no allegedly to it. Not illegal to disclose vulns publicly, though I wait 90 days after vendor notification based on industry convention.