[chc]

I'm not sure what "ownership" is supposed to mean in this context. Legally speaking, how does one "own" a security vulnerability?