What would you do if you discovered a security vulnerability in production?