This policy outlines my approach to vulnerability disclosure, providing a timeline for vendors to respond and remediate.

Upon identifying and reporting a vulnerability to a vendor, I initiate a 45-day countdown for the vendor to develop and release a patch addressing the identified issue.

If the vendor successfully patches the vulnerability within the 45-day timeframe, I will publicly disclose the vulnerability 30 days after the patch is released. This gap aims to provide users adequate time to apply the patch, enhancing their security posture before the vulnerability details become public knowledge.

If a vendor does not patch the vulnerability within the initial 45-day window, I will proceed with public disclosure immediately following the 45-day period.

Examples

• If a vendor issues a patch 35 days after initial vulnerability disclosure, public disclosure would be scheduled for day 65.
• If no patch has been released 45 days after initial vulnerability disclosure, public disclosure would occur on day 45.

Accelerated Disclosure

I reserve the right to publicly disclose ahead of schedule in unique circumstances, such as active exploitation or a public exploit. Such disclosures aim to equip the community with information necessary for risk mitigation.