Is this kind of language common in other security disclosures?