Are there any legal obligations to report discovered vulnerabilities?
The policy may outline legal obligations related to reporting vulnerabilities, which can vary based on jurisdiction and specific regulatory requirements.