Most of them follow specific timelines for those disclosures which are communicated with the affected vendor.
Is selling an exploit to a foreign government even 100% legal? (Serious question; that seems like the sort of thing that could get one in trouble.)