I'm slightly wary about this "90 day disclosure timeframe". There's no way 90 days should be THE standard. Coordinated disclosure should be highly dependent on the situation.
90 days is far too long for most issues. I get why the industry likes that; a generous timeframe makes their bug fixing efforts look better. But I'm not sure that it's in anyone else's interests.
90 days is far too long for most issues. I get why the industry likes that; a generous timeframe makes their bug fixing efforts look better. But I'm not sure that it's in anyone else's interests.