vulnerability reporting