Correct. And as I tangentially mentioned, even if you do think this needs to be kept secret, then the blog author would still be wrong, because this blog post is doing is doing way more “harm” by publicizing the issue than any amount of commit notes ever could.

But yes, trying to keep this secret like a 0-day is completely the backwards model for how to handle it.