They clarified their responsible disclosure policy here in 2010: http://googleonlinesecurity.blogspot.com/2010/07/rebooting-responsible-disclosure-focus.html h

They clarified their responsible disclosure policy here in 2010: http://googleonlinesecurity.blogspot.com/2010/07/rebooting-responsible-disclosure-focus.html http://googleonlinesecurity.blogspot.com/2010/07/rebooting-r... (tl;dr: 60 days for the vendor to it fix it). Would like to know if they followed it in this case.