Once the reported vulnerability has been confirmed, our engineers will work on developing the appropriate fix(es). Occasionally there are vulnerabilities that cannot be resolved within the 90 day timeline. If more time than the normal confidentiality window is needed, we will work with you to extend the confidentiality window or advise otherwise.