[tptacek]

That is rarely true, and also besides the point: if you report the flaw and they acknowledge it, what does verification matter?