Comment by barkbro

What's the rationale for disclosing vulnerabilities to for example Google before going public (unless the bug is in Google's software)?