Vulnerability and incident reporting