Is there a reason you didn&#x27;t publicly disclose after 90 days? (I&#x27;d argue that the criticality of the vulnerability would justify a 7-day timeframe). The one problem with the way the security community deals with large vulnerabilities is that the researchers don&#x27;t stick to their guns regarding responsible disclosure. I would prefer to know that I have to do &lt;XYZ&gt; to minimise the impact rather than find out that I was vulnerable for more than 5 months. Hell, I&#x27;d be happy to stop using my smartphone for a week if it meant the problem would be solved faster.