Can a hacker publicly disclose vulnerabilities found in my application?

Disclosure of any report is possible only after the client’s permission.