Normally what happens is that the vendors get a chance to evaluate the verification, but that in the public's interest the working exploits don't get distributed.