Project Zero replaces 90+30 with Full 90 policy

Project Zero announced a new vulnerability disclosure policy called Full X to replace its previous 90 plus 30 timeline, citing the increased speed of AI-assisted vulnerability discovery and exploitation. Starting immediately, the policy is Full 90, which will transition to Full 60 on February 2, 2027, and Full 30 on January 3, 2028. The new policy removes most special cases like grace periods and variant policies to encourage faster vendor remediation and reduced patch gaps. Open article →