In reply to Plugin Vulnerabilities.

Good practice: Insecure code is identified, reported responsibly and then an update is release.
Bad practice: Security vendor posts details of the vulnerability publicly, including a proof of concept, to attempt to (a) drive attention towards his firewall, and (b) blackmail the WordPress.org moderators into overturning his ban from the forums for said bad practice.