The 90 Day disclosure policy is dead
Key takeaways
- The 90 day responsible disclosure window was built for a world where bug finders were rare and exploit development was slow.
- I have been doing security work for a while now, and the last 12 months feel different.
- The vendor takes a few days to triage, a couple of weeks to fix, maybe a month to roll out.
The 90 day responsible disclosure window was built for a world where bug finders were rare and exploit development was slow. That world is gone. LLMs have compressed both timelines to near-zero. I have seen it first hand, and so has everyone else paying attention. This post lays out why the old model is broken, with real stories, and makes one ask to the industry: treat every critical security issue as P0 and patch it immediately. Not tomorrow. Not next sprint. Now.
I have been doing security work for a while now, and the last 12 months feel different. Not in a AI is going to take over the world way. In a much more boring, much more practical way. The tools we use, the tools attackers use, and the tools researchers use to find bugs have all gotten smarter at roughly the same speed. And that has quietly killed some of the fundamental assumptions the security industry has been running on for over a decade. Let me walk you through what I mean, with stories.
Pretend it is 2019. You find a critical bug. You write up a report. You send it to the vendor. The vendor takes a few days to triage, a couple of weeks to fix, maybe a month to roll out. If you follow Google Project Zero style disclosure, you give them 90 days before going public. During those 90 days, you assume: