ByteDance then publishes an advisory on BSRC, crediting the researcher (unless anonymity is requested).