Scaling security with responsible disclosure