To ensure that a vulnerability disclosure doesn’t cause more problems than it solves, we recommend a few simple principles.