Responsible vulnerability reporting

PRs opened so far: