The bug,
not the brand.

Every vulnerability I find gets reported privately to the company that owns it. Once the fix ships, the write-up lands here — the bug class, the reasoning, the impact, and the fix.

Companies are never named. No domains, no identifying screenshots, no timelines precise enough to fingerprint a vendor — even after the fix has shipped.