Makes me wonder if we should have a white-hat government org that notifies big corporations or software projects about critical vulnerabilities in their code.