Vulnerabilities in hardware and software products are a gateway for cyber criminals, and state actors should thus be interested in promoting responsible disclosure and timely remediation. However, intelligence and security agencies also exploit vulnerabilities, sometimes holding vulnerabilities back or even actively seeking to acquire them. Thus, the role of state actors within the global vulnerability…