Primarily, three philosophies are followed in the industry regarding security vulnerabilities:
- Full Disclosure
- No disclosure
- Responsible Disclosure
In full disclosure the security researcher who discover vulnerabilities openly announce the details of the vulnerability and in most cases a PoC of the exploit is also provided with the disclosure information. This idea was prevalent in the 90s when security researchers used to announce security vulnerabilities on almost daily basis in Windows, Linux, and other software on websites such as Full Disclosure and Bugtraq mailing list.
The second philosophy is that of no disclosure. For example, in case of patch Tuesday Microsoft releases a lot of fixes for the vulnerabilities you don't know anything about other than a short description. This philosophy is usually followed by private security researchers working in collaboration with the software vendor. It is also followed by the internal security/QA team of the vendor.
The third and most widespread philosophy followed nowadays is the responsible disclosure policy. Here, the security researcher who discover the vulnerability give sufficient time (one month is the bare minimum in most cases) to fix the vulnerability. After that time the security researcher disclose the vulnerability and exploitation details to the public even if the vendor don't patch the security hole. This is called responsible disclosure since the vendor has enough time to provide a patch of the vulnerability and don't expose critical machines to be exploited freely.
You can follow the third option since it is the one followed by most of the security researchers nowadays and provide protection to both the vendor of the software as well as the security researcher and user of the software in ensuring that the vendor will provide a patch for the vulnerability because of the pressure of the impending date of full disclosure.