2 ms·

I'm assuming that policy was designed for general bug reports, rather than specifically for security bugs? Especially if this was 20 years ago.