3 ms·

I think the parent comment was asking why they didn't disclose immediately after it was fixed.

• LinuxBender 4y ago
  In that case I would have to defer to @albertpedersen
  • albertpedersen 4y ago
    The bug was initially reported to Cloudflare's private bug bounty program since there was no public program at the time. Like it or not, the private program does not have the same disclosure policy as the public program does. In early July I asked if the report could be disclosed, seeing as things had changed since the bug was originally reported. Cloudflare agreed and the report was then moved to the public program. As to why it was disclosed now rather than in February when the public program launched, that was my fault for not asking earlier.