# Policy and Disclosure: 2026 Edition

Source: [Project Zero](https://projectzero.google/2026/11/disclosure-policy.html) · 2026-11-13 · Security
Page: https://themorning.dev/story/policy-and-disclosure-2026-edition-1838248a60d90440
Kind: policy · Impact: medium

## In brief

- Since 2021, Project Zero has used a "90 + 30" vulnerability disclosure policy.
- Vendors get up to 90 days to fix a reported vulnerability, plus 30 days of "soak time" for patch rollout.
- The 2026 Edition of the policy was published on 2026-11-13.

## Why it matters

Developers and vendors who receive vulnerability reports from Project Zero get a defined window to fix issues and roll out patches before details are disclosed.

## Timeline

- 2021-01-01: Project Zero begins following the 90 + 30 disclosure policy
- 2026-11-13: Project Zero publishes Policy and Disclosure: 2026 Edition

## Coverage

- [Policy and Disclosure: 2026 Edition](https://projectzero.google/2026/11/disclosure-policy.html) — Project Zero, 2026-11-13

Tags: vulnerability-disclosure, security-policy, project-zero, patching

---

Brief generated by AI (claude-haiku-5-5) from the reporting listed under Coverage. Headlines belong to their publishers. The Morning Dev – https://themorning.dev