what you will do after you discover and disclose all vulnerabilities [or at least the major ones]?