Apparently its a torguard-vulnerability. To tag a vulnerability as 'trade secret', and the fact that the disclosure process involved threats (allegedly) is a very bad reflection on both of them. Why should I trust either of them to handle security vulnerabilities responsibly in the future?