The answer to #1 is in the wired article about Project Zero: "When Project Zero’s hacker-hunters find a bug, they say they’ll alert the company responsible for

The answer to #1 is in the wired article about Project Zero: "When Project Zero’s hacker-hunters find a bug, they say they’ll alert the company responsible for a fix and give it between 60 and 90 days to issue a patch before publicly revealing the flaw on the Google Project Zero blog. In cases where the bug is being actively exploited by hackers, Google says it will move much faster, pressuring the vulnerable software’s creator to fix the problem or find a workaround in as little as seven days." http://www.wired.com/2014/07/google-project-zero/ http://www.wired.com/2014/07/google-project-zero/