Vulnerability disclosure principles that vendors, open source, and operators can use to be ready for the day when an emergency patch is needed.