Vendors should keep sensitive vulnerability information confidential. It falls into two groups: identifying details about people or organizations, for example a reporter's name when they have asked to stay anonymous, or a compromised customer's IP addresses; and vulnerability details that are not yet public or broadly known, for example a vulnerability still under investigation or technical detail that would give attackers undue help. Vendors should apply sensible operational security, such as restricting access to the units and people who need it and encrypting information sent over untrusted channels such as email, because early disclosure increases costs and risks for both vendors and users. How tightly information is protected should depend on how much it could help someone build an exploit and on what is already public.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.