The department discloses... What about the hackers?
Seems to me that hackers are asked to hack. As such, they may or may not be asked to make the hack used part of the official catalog. So a simple work around to this is that you tell the hackers to only report the zero days that were low hanging fruits.