Disclosing security issues in a manner that is both useful to software developer and software user can be a difficult task.
It is about how to get the defect resolved with the smallest impact to the user.