The "Equities Process" governs how to handle publicizing security issues. Normally, flaws and vulnerabilities are not announced until after they are fixed. The government will only withhold a bug if there was an “overriding intelligence reason,” and will require sign off from a high-level official.
U.K. Agency Ups Transparency Protocols to Combat Threats
The National Cyber Security Centre in the U.K. announced a new public disclosure process with respect to “potentially sensitive software flaws.” So reports NBC News.
