Starting today, our policy is “Full 90”, i.e. vulnerabilities will be disclosed 90 days after they are reported to the vendor.

On February 2, 2027, we will move to a “Full 60” policy where vulnerabilities are disclosed after 60 days.

On January 3, 2028, we will move to a “Full 30” policy where vulnerabilities are disclosed after 30 days.