An independent security researcher discovers a critical authentication bypass in a company's public web application. The company has no formal bug bounty program. The researcher privately emails the company's security team with technical details and states they will wait 90 days before publishing the findings publicly. Which vulnerability identification method does this describe?