There is no such thing as "the responsible disclosure protocol".