It's a hot topic of debate. Some people advocate for full disclosure, which means tell everyone as soon as you find it. The idea behind that is that attackers m

It's a hot topic of debate. Some people advocate for full disclosure, which means tell everyone as soon as you find it. The idea behind that is that attackers might have already found it and be exploiting it, so people should know in order to protect themselves. Others advocate for coordinated disclosure (sometimes called responsible disclosure, a controversial term[1]), with some sort of time limit. Google Project Zero does that with a 90-day time limit, with some exceptions to extend it or reduce it[2]. [1] https://news.ycombinator.com/item?id=12308246 https://news.ycombinator.com/item?id=12308246 [2] https://googleprojectzero.blogspot.com/2021/04/policy-and-disclosure-2021-edition.html https://googleprojectzero.blogspot.com/2021/04/policy-and-di...