When a CVE is published, the vulnerability has already existed for some time. The gap between discovery and public registration—the disclosure gap—is a period when scanners show nothing, SLAs are not triggered, and the environment seems clean. In this article, Heitor Gouvêa documents four real cases of responsible disclosure and what this gap means in practice for those managing risk.