Google’s Project Zero has replaced its 90+30 disclosure policy with “Full X”, a fixed deadline that makes a bug public X days after it’s reported to the vendor. Natalie Silvanovich announced it in a Project Zero post dated 13 November 2026: X is 90 now, drops to 60 on 2 February 2027 and drops to 30 on 3 January 2028.
Since 2021, Project Zero had given vendors 90 days to fix a bug, then held the details back for 30 more days so the patch could reach users. Project Zero’s disclosure FAQ also lists a 14-day grace period for vendors close to shipping a fix. The new post removes the grace period and the variant policy, and says soak time is no longer meaningful.
What changed
Under Full X, the date depends only on when the vendor was told. A fix doesn’t start a second clock, and Project Zero says it will still track whether bugs are fixed and tell people when they aren’t, but that “will not be a decision point in our policy”.
| Item | 2021 policy (90+30) | New policy (Full X) |
|---|---|---|
| Deadline | 90 days | 90 days now, 60 from 2 Feb 2027, 30 from 3 Jan 2028 |
| Bug fixed in time | Details public 30 days after the fix | Details public at the deadline |
| Grace period | 14 days on request | Removed |
| Variants of a reported bug | Added to the existing report, no new deadline | Removed |
| Exploited in the wild | 7-day deadline | Google’s application security policy |
Three exceptions remain. Bugs already being exploited in the wild follow Google’s application security vulnerability disclosure policy, which Project Zero’s FAQ says means a 7-day deadline. Project Zero can publish a bug at its discretion if others have already made the details public. And it will publish any bug when the vendor it reported to asks.
Severity doesn’t set the date either. Project Zero says it only reports bugs with substantial severity and demonstrated security impact, and that severity “does not affect the likelihood that it will be discovered by attackers, only its impact on users”. For hardware, it says it has granted exceptions “on rare occasions”, including Spectre and Meltdown, and will keep doing so.
Why Project Zero made the change
Silvanovich’s post puts the cause on large language models, the AI systems behind chatbots and coding tools. Project Zero says they’ve sped up how fast attackers find and exploit bugs, and raised the chance that more than one party, including a malicious one, finds the same bug during an embargo. It calls the old remediation timeline “clearly insufficient”.
The post also says LLMs have cut the time it takes to turn a patch into a working exploit, to the point where “zero patch-to-exploitation time is a reasonable, though imperfect, model of attacker behavior”. That’s why soak time goes: Project Zero says holding details back after a fix creates a false sense of secrecy. It defines patch gap as the time between a fix shipping and users installing it, and asks vendors to shrink it by faster rollout or other protections while a fix is in progress.
Volume is the third reason. Project Zero says it’s now finding several vulnerabilities a week in targets where it once found a few a year, so negotiating each bug’s fix status and grace period with vendors is “quickly becoming unmanageable”. As of 29 July 2025, the FAQ says, 95.5% of Project Zero’s reports across its lifetime had been fixed under deadline.
Project Zero asked the vendors it reports the most bugs to for feedback before choosing the schedule. They told it that cutting the deadline at once could expose unfixed bugs while they improved their processes, that a harsh deadline could pull fixes for less severe bugs ahead of worse ones, and that an unmeetable deadline could lead vendors to stop trying. Project Zero says the stepped schedule is “challenging but realistic”. Its 2021 policy post had also said it would lower both timelines over time, and floated 84+28 for 2022.
What it means for vendors and defenders
For a vendor, the date is fixed on the day Project Zero’s report arrives. Under the 2021 rules, a bug fixed on day 40 became public on day 70. Under Full 90 it becomes public on day 90, and an unfixed bug is public on day 90 under both. The FAQ’s own example of why Project Zero added a grace period was a vendor whose monthly patch release landed two days after the deadline. That vendor now gets no extension.
Project Zero encourages vendors to plan for imminent disclosure of a serious bug, including with strategies that don’t involve a patch, and points to its October post on emergency patching. It says more vendors are trying remediation such as temporarily disabling code paths, which makes judging whether a bug is fixed harder, so it will share technical details of how users are protected instead of ruling on whether a bug counts as fixed.
For defenders, the bug report becomes public at the deadline whether or not a patch exists, and no 30-day wait follows a fix any more. Project Zero’s post says attackers can work out bug details from a patch almost immediately, so the post treats the time users spend on unpatched software as the exposure to cut.
Project Zero’s post doesn’t name the vendors it consulted, and it doesn’t say how the new policy treats reports filed before 13 November. The next change is Full 60 on 2 February 2027.
Discover more from Sulat AI & Tech News
Subscribe to get the latest posts sent to your email.
