...
Security vulnerabilities may be discovered in a number of ways. Some may be discovered directly by developers or during testing and thus be known from the onset to be security related defectsdefectdefect. In other circumstances a previously reported defect may be recognized to be security related at a later time.
...