Google's Project Zero updates its vulnerability disclosure policy to include a 30-day cushion before publishing bug details to give users time to apply patches
The Google Project Zero security team has updated its vulnerability disclosure guidelines today to add a cushion of 30 days …
The new 30-day post-patch window shifts the policy’s emphasis from pressuring vendors to patch toward giving affected users a defined period to deploy those patches before technical details become public.
First-order effects
Google’s Project Zero will delay publication of bug details for 30 days after a patch is available, giving users and organizations a longer deployment window.
Software vendors receive a clearer interval between releasing a fix and Project Zero’s technical disclosure, while users must prioritize patching within that window.
Second-order effects
Vendors’ patch-release planning becomes more consequential: a fix that is available but difficult for customers to deploy leaves less of the disclosure window usable in practice.
The change softens the operational edge of Project Zero’s prior deadline model, which had already shown flexibility through its vendor-requested grace period.
Third-order effects
If Project Zero maintains this approach, coordinated disclosure norms may increasingly measure success by both patch availability and patch adoption, rather than the vendor’s fix date alone.
The policy preserves deadline-driven pressure while formalizing a user-protection phase, a model other vulnerability-reporting programs may weigh against immediate publication rules.
The trend: Vulnerability disclosure policies are evolving from fixed vendor deadlines toward staged timelines that account for users’ ability to deploy patches.
Google's Project Zero team has updated its vulnerability disclosure guideline to add a 30-day patch cushion Per the new rules, once a bug is patched, Project Zero will wait another 30 days before publishing technical details to give users time to patch https://therecord.media/...…
This is great but I can already see companies abuse this and not put much effort to patch because they will feel secure for 30 more days. In reality, attackers can reverse the changes in a patch. https://twitter.com/...
Might as well tack on another 30 days for the FBI to clean things up, and then users and admins don't need to be involved at all. https://twitter.com/...
Project Zero's 2021 Disclosure Policy Update. Biggest changes: 1) if a bug is fixed under deadline, the technical details are released 30 days after the fix 2) we're planning to reduce the 90 day deadline starting next year Full post & reasoning here: https://googleprojectzero.bl…
I applaud the decision to give more time. Separate from that thought, this is an acknowledgment that the way things were being done before wasn't optimal, and that the security community is largely still making it up. That means don't act like this is all figured out. https://twi…
Expect the change to reverberate through the vulnerability research and bug hunting communities, which often use P0 rules as some sort of unofficial guideline
From the standpoint of defenders, this is a good and welcome change. All many of them want (well, the responsible ones) is some fair chance to test & patch. The ITW 0day guidelines are still unreasonable though. At least as the 10 day limit applies to non-RCE/non-critical bugs. h…
“we didn't observe a shift in patch dev timelines, & we continued to receive feedback from vendors they were concerned about publicly releasing tech details about vulns & exploits before most users had installed the patch..the implied timeline for patch adoption wasn't understood…