Patch Test Is The Disclosure

A vendor advisory deliberately withholds the gadget chain, exploit details, or other operational specifics of a security bug. The same vendor's patch commit, public on the project's open-source repository at the same release window, ships a regression test that exercises the chain end-to-end. Regression tests for the patched primitive are by construction the smallest input that reproduces it; for deserialization, command injection, or auth-bypass bugs that input IS the working exploit. The advisory's withholding is a documentation choice that depends on a defender reading only the advisory. The patch's test class is the same project, on the same day, naming what the advisory refused to publish.