>Should there be similar deficiencies in VFP then I could go along with keeping mum about them provided that all other VFP bugs were full disclosed in a timely manner.

Huh? So we'll only keep security bugs secret if (or only if?) all other bugs are fully disclosed? I don't see why thats relevant at all.