It's not about bending to another company's internal policy. It's about having etiquette for the company patching the vulnerability that extends beyond the basi

It's not about bending to another company's internal policy. It's about having etiquette for the company patching the vulnerability that extends beyond the basic rules; especially when it could harm users. What Google did certainly stayed within normal policy, but that doesn't make it good form.