It takes a particularly vicious and nihilistic jerk to claim there's a vulnerability in a FOSS project and doesn't disclose it in any way.