Security Experts:

Connect with us

Hi, what are you looking for?



Facebook Announces Vulnerability Reporting and Disclosure Policy

Facebook is giving third-party application developers three weeks to respond to vulnerability reports and three months to patch bugs before public disclosure. 

Facebook is giving third-party application developers three weeks to respond to vulnerability reports and three months to patch bugs before public disclosure. 

The social media giant took the wraps off a Vulnerability Disclosure Policy this week, aimed at bugs its researchers may discover in third-party code and systems, open source applications included. 

The purpose of the policy, Facebook says, is to make sure that the identified issues are addressed as fast as possible and that the impacted people are informed on the matter, so they can patch their systems to stay protected. 

The social platform also notes that high-impact security flaws will receive more care before public disclosure, and that its researchers will work closely with application developers to aid with the fixing process whenever needed. 

“We expect the third party to respond within 21 days to let us know how the issue is being mitigated to protect the impacted people. If we don’t hear back within 21 days after reporting, Facebook reserves the right to disclose the vulnerability. If within 90 days after reporting there is no fix or update indicating the issue is being addressed in a reasonable manner, Facebook will disclose the vulnerability,” the company says

Facebook also reveals that, should it determine that disclosing a vulnerability prior to the established timeframe would benefit the public, it may do so. 

As part of the responsible disclosure process, Facebook will make a reasonable effort to contact the impacted third-party and will provide them with the information required to understand the reported problem. Additional information will be delivered if needed. 

“If we do not receive a response within 21 days from a contact acknowledging the report of a vulnerability, we will assume that no action will be taken. We then reserve the right to disclose the issue,” Facebook says. The sending of the report is considered to be the beginning of the timeframe. 

The company says it is willing to work with the third-party on fixes, but expects transparency on the mitigation progress. The third-party is expected to address the reported vulnerability within 90 days and, if no mitigating circumstances are identified, Facebook will disclose the issue publicly as soon as it can. 

Facebook’s Vulnerability Disclosure Policy also details disclosure paths, as well as potential scenarios when the company will deviate from the 90-day patch requirement, such as active exploitation of the identified security flaw or unnecessary delays on deploying a fix. 

“We will strive to be as consistent as possible in our application of this policy. Nothing in this policy is intended to supersede other agreements that may be in place between Facebook and the third party, such as our Facebook Platform policies or contractual obligations,” the social platform says. 

Facebook also introduced WhatsApp Security Advisories this week, a resource designed to increase transparency through providing information on all of the vulnerabilities that have been addressed in the messaging service and applications. 

“Due to the policies and practices of app stores, we cannot always list security advisories within app release notes. This advisory page provides a comprehensive list of WhatsApp security updates and associated Common Vulnerabilities and Exposures (CVE). Please note that the details included in CVE descriptions are meant to help researchers understand technical scenarios and does not imply users were impacted in this manner,” the company says.

Additionally, Facebook says it will notify developers of third-party libraries and providers of mobile operating systems when security issues that impact their code is discovered. 

Related: Google Project Zero Updates Vulnerability Disclosure Policy

Related: Zero-day Vulnerability Highlights the Responsible Disclosure Dilemma

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join this webinar to learn best practices that organizations can use to improve both their resilience to new threats and their response times to incidents.


Join this live webinar as we explore the potential security threats that can arise when third parties are granted access to a sensitive data or systems.


Expert Insights

Related Content


Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...


Apple has released updates for macOS, iOS and Safari and they all include a WebKit patch for a zero-day vulnerability tracked as CVE-2023-23529.

Application Security

Drupal released updates that resolve four vulnerabilities in Drupal core and three plugins.

Cloud Security

VMware vRealize Log Insight vulnerability allows an unauthenticated attacker to take full control of a target system.

Application Security

A CSRF vulnerability in the source control management (SCM) service Kudu could be exploited to achieve remote code execution in multiple Azure services.

IoT Security

Lexmark warns of a remote code execution (RCE) vulnerability impacting over 120 printer models, for which PoC code has been published.


GoAnywhere MFT users warned about a zero-day remote code injection exploit that can be targeted directly from the internet