Defensive approach
Reports should prioritize detection, mitigation, and coordinated remediation.
Any detail that lowers the cost of exploiting a real system before remediation is blocked.
Provisional channel
There is no verified security mailbox on the domain yet. One will not be published until receipt, encryption, and follow-up are confirmed.