I hear ya, but white hat usually privately discloses vulnerabilities don't they?