Plan a Responsible Disclosure Timeline

Enter the date you reported a vulnerability and your disclosure policy window. This tool maps every milestone — vendor acknowledgment, patch deadline, and the public-disclosure date — so you never miss a coordinated release.

How the timeline is calculated

Coordinated vulnerability disclosure runs on a fixed clock that starts the day you notify the vendor. This generator treats your report date as day 0 and projects every downstream milestone by simple date arithmetic — no calendar guesswork. Each event is reportDate + offsetDays, converted through the millisecond epoch so leap years and month lengths are exact.

The core formula is:

publicDate   = reportDate + windowDays
ackDeadline  = reportDate + ackDays
graceDate    = reportDate + windowDays + graceDays
elapsed%     = clamp( (today - reportDate) / windowDays * 100, 0, 100 )

The window defaults to 90 days — the de facto industry norm popularized by Google Project Zero and aligned with CERT/CC guidance. Shorter windows (30–45 days) suit web apps where patching is cheap; longer ones (180 days) fit firmware and embedded systems where supply-chain rollout is slow. The grace period models the common policy clause that grants a short extension when a vendor demonstrably has a fix in flight, pushing disclosure to window + grace rather than punishing good-faith remediation.

The information gain over a plain countdown is the urgency banding: the tool computes the elapsed fraction of your window and labels the case On track, Halfway, Final stretch, or Overdue, plus a live days remaining figure recomputed against today's date. The optional weekend shift moves any deadline that lands on a Saturday or Sunday to the following Monday, because most vendor security teams and CNAs do not process coordinated releases over a weekend. Everything runs locally in your browser — no report data ever leaves the page, which matters when the dates themselves hint at an unpatched, exploitable bug.