Public disclosure once patches are available is a fairly common policy. Google's Project Zero operates like that as well.