Feedback and data-driven updates to Google’s disclosure policy

A Google Project Zero roundup of the November 2014 Patch Tuesday advisories covering bugs reported by the team.

A Google Project Zero publication of details on Mac OS X and iPhone sandbox escape bugs after Apple shipped fixes.

The founding announcement of Google Project Zero, a team dedicated to researching and reporting security bugs with the goal of making the internet safer.

depthfirst's coordinated disclosure policy: every report is human-verified and includes a PoC and fix guidance; vendors get 30 days to patch, then a 7-day adoption window before publication.

The author argues the industry lacks a standard vulnerability disclosure channel and proposes RFC2142 mailboxes such as security@ and abuse@ as a simple convention for routing reports.

Project Zero's 2025 update to its vulnerability reporting and disclosure policy, restating the research agenda, disclosure timelines, and how in-the-wild issues are handled.