Agents of responsibility in software vulnerability processes