A few years of heads up is sufficient to disclose publicly. Full disclosure helps keep companies honest about security.