reporting vulnerabilities