Does your company have a policy? What do you think about it? How do you handle vulnerability disclosure personally? What factors should be considered?