“security researchers uncovered the flaw simply by careful reading of the documentation of the startup process”