Coordinated vulnerability disclosures operate on a straightforward premise: the affected vendor is notified first, given a defined window to remediate, and public disclosure follows.