I like when "following standard practice, literally listed in the bug report and used 100's of times" is suddenly "counter-pr efforts" I like when "following standard practice, literally listed in the bug report and used 100's of times" is suddenly "counter-pr efforts"

type: vulnerability is new, but if you search the public bug tracker for the phrase "This bug is subject to a 90-day disclosure deadline",

It looks like they have been pretty darn consistent about unrestricting once the patch is available. Usually faster than 7 days! They have also held people to the 90 day requirement, and the 14 day grace extension they offer This is true even when the reporter is a googler or it affects only google software.