b. For vulnerabilities that are publicly disclosed by other parties without a patch, is there a policy to
provide public commentary before a patch is available?
c. Which details are disclosed to customers? What is disclosed to the general public?
d. Are any credits or compensation provided to independent vulnerability researchers?