Comment 9 for bug 2012993

This seems like something we would normally just switch to public immediately and fix in master as a security hardening measure, backporting if possible whenever convenient. If Tony or others involved in the report disagree with my assessment, perhaps if I've misunderstood the nature of the reported vulnerability for example, then we shouldn't switch it to public yet until we're sure everyone is on the same page.