A "90 days no matter what" policy has the advantage that it takes any thought out of the disclosure process. It also has the disadvantage that it takes any tho

A "90 days no matter what" policy has the advantage that it takes any thought out of the disclosure process. It also has the disadvantage that it takes any thought out of the disclosure process. Perhaps responsible disclosure occasionally requires considering the unique circumstances of each security flaw?