90 days, 30 days, 45 days: disclosure deadlines explained

Coordinated disclosure deadlines give a vendor time to fix a flaw before details go public. Google Project Zero allows 90 days to patch and publishes 30 days after a patch ships. CISA says it may disclose as early as 45 days after first contacting an unresponsive vendor.

Why deadlines exist

Without a deadline, a reported flaw can sit unfixed while attackers find it independently. With a deadline that is too short, users get details before they can patch. Published policies try to balance the two, and they tell both sides what to expect.

Project Zero: the 90 plus 30 model

Project Zero's policy gives vendors 90 days from notification to release a patch. If the patch lands in time, details become public 30 days after the patch is available. If it does not, details become public at day 90.

Worked examples from the policy:

• Patch on day 47: disclosure on day 77.
• Patch on day 83: disclosure on day 113.

There is a grace period. If a vendor asks for more time and can patch within 14 additional days, Project Zero may grant it, and details are then published on day 120.

For flaws exploited in the wild, the clock is shorter. The deadline is 7 days, with a grace period of 3 days, and details are published on day 37 regardless of when the patch lands inside that window.

CISA: the 45 day floor for unresponsive vendors

CISA's coordinated disclosure process lists factors that affect timing: whether the flaw is already public or exploited, its impact, how responsive the vendor is, and whether mitigations exist. If a vendor is unresponsive or will not commit to a reasonable remediation timeframe, CISA may disclose as early as 45 days after the first attempt to contact the vendor, even without a patch.

What this means if you are the vendor

• Assume a clock starts when the report arrives. Acknowledge fast so the reporter knows you are engaged.
• If you need more time, ask early and explain why. Silence is what triggers early disclosure.
• Plan your patch release process around the shortest realistic deadline for severe issues.
• The OWASP guidance suggests agreeing a disclosure timeline with the reporter, and treats the 90 day figure as a reference point, not a mandate.

What this means if you are the reporter

• State your timeline in your first message.
• Say what you will do if the vendor does not respond.
• Keep a log of contact attempts. CISA's 45 day figure counts from the first attempt.
• Be flexible when a vendor is making visible progress.

Putting dates in your own policy

Your policy does not have to copy any of these numbers. A workable pattern: acknowledge in a few business days, assess in about a week, aim to fix within a stated period, and say you will agree a disclosure date with the reporter. If you want a firm number, state it and say what happens when you miss it.

Quick check

Sources

• Project Zero disclosure policy
• CISA coordinated vulnerability disclosure process
• OWASP Vulnerability Disclosure Cheat Sheet

Last reviewed: 19 October 2026.