Security vulnerabilities: discovery and disclosure