CV0-004: CompTIA Cloud+

Industry-standard responsible (coordinated) vulnerability disclosure practice requires that a researcher first privately notify the vendor—typically through a dedicated security contact email or disclosure channel—before taking any other action. This gives the vendor the opportunity to investigate and remediate the issue before details become public, minimizing the risk that malicious actors exploit the flaw. Publicly posting about the vulnerability (via a blog post or a public issue tracker) before the vendor has been informed and had a chance to patch it would expose users to unnecessary risk, and simply uninstalling the package does not address the vulnerability for the broader user base.