7 days is a fine maximum, but not necessarily a target. A malicious 3rd party script should be removed in an hour. Are there any independent groups that rate a

7 days is a fine maximum, but not necessarily a target. A malicious 3rd party script should be removed in an hour. Are there any independent groups that rate a firm's response to an exploit? Other than HN comments and (rare) legal recourse, I don't know what pressure a YC startup faces to do a good job in a holistic sense. It'd be nice if a respected 3rd party were around to shame sites if necessary.