When a vulnerability is being exploited against real users, deadlines shrink. Under Project Zero's published policy, the standard 90 days becomes 7 days for in-the-wild exploitation. Vendors who plan for the short clock handle these cases better than those who treat every report as a 90 day project.
The standard clock
Project Zero's policy gives vendors 90 days from notification to make a patch available. If the patch ships within that window, details are published 30 days after the patch reaches users. If it does not, details are published at the end of the 90 days. A vendor that can patch within 104 days may be granted a grace period on request, with publication on day 120.
The short clock
If Project Zero finds evidence of active exploitation against real users, the deadline is 7 days instead of 90. The 30 day post-patch window still applies if the patch ships by day 7. The grace period for these cases is 3 days, through day 10, and a patch in that period still leads to publication on day 37.
Project Zero and a vendor can also agree to publish earlier than the policy dates.
Why vendors should care
This is one researcher group's policy, not a law. Other researchers and coordinators use different timelines. CISA says its timing depends on exploitation status, impact, vendor responsiveness and mitigation, and that it may disclose as early as 45 days after first contact when a vendor does not respond. The pattern is the same: exploitation raises urgency.
What to prepare
- An on-call route for security fixes that does not wait for the next sprint.
- A way to ship an emergency patch or mitigation in days.
- A pre-approved communication template for customers.
- A contact at your key customers and a way to notify them.
- A decision owner who can approve disclosure early.
What researchers should note
Evidence matters. A claim of exploitation should rest on something you can describe, such as observed attacks or credible reports. Say what you saw and how you know. Overstating urgency costs credibility.
For the broader picture of timelines, read disclosure deadlines explained and the coordinated disclosure guide.
Quick check
Is 90 days a legal requirement?
No. It is the policy of one research team. Your own policy and agreements govern your reports.
Does a short deadline mean a full fix?
Not always. A mitigation or workaround can be an acceptable interim step if you say clearly that it is one.
Sources
- Project Zero: Vulnerability Disclosure Policy
- CISA: Coordinated Vulnerability Disclosure process
Last reviewed: 19 October 2026.
