"public" here has nothing to do with government holding on to vulns. it's about landing fixes and coordinating complicated / impactful findings