Vulnerabilities
Responsible Disclosure
Also: coordinated disclosure, CVD
Reporting a vulnerability privately to the vendor and giving them time to fix it before going public.
In more detail
Most programs set a window, commonly around 90 days, though terms vary. A clear reporting channel, published as a security.txt file, makes it easy for researchers to do the right thing.