Tag vulnerability disclosure policies