“Found vulnerabilities and responsibly disclosed them” is the public line but yes.