Polygon disclosed previously private security flaws that posed denial-of-service and validator risks after fixes were deployed through two hard forks.