Google Project Zero Changes Its Disclosure Policy

Google Project Zero Changes Its Disclosure Policy - Schneier on Security

Google’s vulnerability finding team is again pushing the envelope of responsible disclosure: Google’s Project Zero team will retain its existing 90+30 policy regarding vulnerability disclosures, in which it provides vendors with 90 days before full disclosure takes place, with a 30-day period allowed for patch adoption if the bug is fixed before the deadline. However, as of July 29, Project Zero will also release limited details about any discov…

Google Project Zero Changes Its Disclosure Policy

Google's Project Zero team will continue its 90+30-day vulnerability disclosure policy and, starting July 29th, will release limited information within a week of disclosure to vendors. This move aims to expedite fixes but may also cause panic. The author believes Google is not a neutral vulnerability hunter.