Maybe I misread the redacted doc [0] but from what I see, it is sent to the Entities Review Board (ERB) that then determines whether they should disseminate. I was unable to find the requirement to disclose. Can you point to it?

0 - https://www.eff.org/document/vulnerabilities-equities-proces...