Policy
Policy and Disclosure: 2026 Edition
Project Zero · By Natalie Silvanovich ·
The Brief
- Since 2021, Project Zero has used a "90 + 30" vulnerability disclosure policy.
- Vendors get up to 90 days to fix a reported vulnerability, plus 30 days of "soak time" for patch rollout.
- The 2026 Edition of the policy was published on 2026-11-13.
Why it matters
Developers and vendors who receive vulnerability reports from Project Zero get a defined window to fix issues and roll out patches before details are disclosed.
Who’s affected
- Software vendors receiving Project Zero reports
- Security researchers and teams handling vulnerability disclosure
- #vulnerability-disclosure
- #security-policy
- #project-zero
- #patching
Since 2021, Project Zero has followed a “90 + 30” vulnerability disclosure policy, allowing vendors up to 90 days to remediate a vulnerability plus an extra 30 days “soak time” for patch rollout. Our goal was to encourage faster patching and give vendors time to deliver patches…
Timeline
Project Zero begins following the 90 + 30 disclosure policy
Project Zero publishes Policy and Disclosure: 2026 Edition
Project Zero
Policy and Disclosure: 2026 Edition