if the disclosure and fix time is half a year, a blackhat is now able to both claim the bug bounty and sell the day zero exploit