Ledger, Trezor call for responsible vulnerability disclosure
AI Summary- Ledger and Trezor urged researchers to privately report vulnerabilities before publication.
- Ninety days is a common default disclosure window, with flexibility for severity and required fixes.
- Jan Komárek said researchers should publish if vendors miss agreed deadlines.