Hacker News Reader

I assume both? I'd be surprised to see a vulnerability fixed without first being discovered.

Technically possible if some obsolete code was deleted but later a historical snapshot was analyzed