# Project Zero cuts bug disclosure to 90 days, falling to 30 by 2028 > Source: > Published: 2026-11-15 12:08:22+00:00 Under the old 90+30 policy, details waited up to 30 extra days after a fix shipped so users could patch. That soak time is gone, and Project Zero cites LLMs shrinking patch-to-exploit time, so vendors now get one fixed clock that drops to 30 days. Read: Under the old 90+30 policy, details waited up to 30 extra days after a fix shipped so users could patch. That soak time is gone, and Project Zero cites LLMs shrinking patch-to-exploit time, so vendors now get one fixed clock that drops to 30 days. Read: The data sat in Supabase databases that answered requests with no login, the gap row-level security exists to close. Lovable frames app security as a shared responsibility, so locking down those tables falls to the builder, not the platform that generated them. Read: The two newest Claude models now tie after harder tasks cut scores about 5 points on average. Cost per task among top setups runs from $1.51 to $44.22, about 30x, and higher effort can score lower because each task has a time limit. Try: With Opus 5.5 or GPT-6.1 Sol held fixed, the harnesses solved similar shares of public dev tasks, so the harness set the cost per solved task. Rules shown every turn were followed far more often than skills the prompt never mentioned. Watch: The Grok Bot team encodes its architecture as enforceable lint rules and spends tokens on runtime and formal verification in TLA+ and Lean. At that volume, a 0.5% revert rate still means about 55 reverted PRs a month. Try: Each run now returns a judgement with success, failure reason, prompt-injection and captcha flags, and site gotchas, scored by a model the user picks. Agent builders who wrote their own grader get one in the library, though it was measured on only 13 runs. Read: Artificial Analysis scored speech-to-text APIs on word-level speaker errors across 97 conversations. The open-weight model's 3.3% is under half of second-place Voxtral Small Transcribe 3 at 7.5%, so a self-hostable model leads paid APIs.