Project Zero has a fairly strict 90 day disclosure timeline, in part to avoid having this discussion for the majority of issues. 90 days passes, issue disclose

Project Zero has a fairly strict 90 day disclosure timeline, in part to avoid having this discussion for the majority of issues. 90 days passes, issue disclosed. But they did recently withhold four disclosures due to the seriousness of the issues: https://googleprojectzero.blogspot.com/2023/03/multiple-internet-to-baseband-remote-rce.html?m=1 https://googleprojectzero.blogspot.com/2023/03/multiple-inte... and not for anything as life-threatening as a pacemaker. It seems that brings the total number of policy exceptions to six. I think one of the keys here is working out your policy in advance, so you've got a robust set of criteria to work from when you need to evaluate a specific case.