Policy and Disclosure: 2026 Edition
Since 2021, Project Zero has followed a “90 + 30” vulnerability disclosure policy, allowing vendors up to 90 days to remediate a vulnerability plus an extra 30 days “soak time” for patch rollout. Our goal was to encourage faster patching and give vendors time to deliver patches to users.
Summary from Google Project Zero.
Explained
The technology and terms in this story. Learn more
