They downplayed the issue repeatedly. If you read the original Google report Cloudflare did not work with the team all that well. The Google team complained tha

They downplayed the issue repeatedly. If you read the original Google report Cloudflare did not work with the team all that well. The Google team complained that Cloudflare was not working with them on the message and was downplaying the risk. > https://bugs.chromium.org/p/project-zero/issues/detail?id=1139#c12 https://bugs.chromium.org/p/project-zero/issues/detail?id=11... According to the Google team the draft Cloudflare sent "contains an excellent postmortem, but severely downplays the risk to customers." There was also a ton of conversation here on this site about the fact that they were downplaying the severity. As for web caches- look, it's great that they were proactively working to get things cleaned up. However, despite the fact that Google called in engineers who cancelled their weekend plans to deal with this, and despite the fact that Google is the one who did Cloudflare's job by finding the exploit, this is what Matt Prince had to say- > I agree it's troubling that Google is taking so long. We were working with them to coordinate disclosure after their caches were cleared. While I am thankful to the Project Zero team for their informing us of the issue quickly, I'm troubled that they went ahead with disclosure before Google crawl team could complete the refresh of their own cache. We have continued to escalate this within Google to get the crawl team to prioritize the clearing of their caches as that is the highest priority remaining remediation step. He essentially through the Google team under the bus. It was completely unprofessional. Finally, the Ragel team themselves had to reach out to Cloudflare to get them to change the language on their announcement because it appeared to many people that the Cloudflare discussion was shifting the blame to Ragel. If you really need more information about this just read the OP this thread is part of.