You should make sure you don't leak the bug report before you have triaged it
A vulnerability report can leak in the first hour. Not via a press post. Via a forwarded email, a ticket titled with the endpoint, a screenshot in a wide chat, or a PoC committed to a repo someone