When it comes to disclosing hacks, standard practice is to disclose a limited hack first, then when the hoopla dies down, disclose that the hack was "worse than previously thought".

See: https://circles.page/5680a56b5c28af0998656e09/Hacks-worse-th...