Disclosure

Vendor first. Every time, including when the vendor makes that policy difficult to enjoy.

Vendors get ninety days from first contact. The clock starts when the report reaches an address the vendor publishes for security reports or support. It does not restart when somebody finally creates the correct Jira ticket.

I would prefer to publish alongside a patch. Publication is not contingent on one. Vendors had the opportunity to find this before I did; responding when someone drops it in their lap is part of the cost of not doing that work themselves.

I may extend the deadline when somebody is engaged, communicating, and fixing a genuinely hard problem. That is my decision and not the default. Silence does not stop the clock.

I generally don’t publish working exploits. I’ll document root cause, reachability, detection, indicators, and enough detail to verify the finding. Most people do not need a copy-and-paste button.

If somebody got there first, they get credit. Findings aren’t brokered. Nothing here is for sale.