Is there a limit to the timeframe in which vulnerabilities can be reported?
The policy may specify a timeframe within which vulnerabilities should be reported, but it generally encourages prompt reporting regardless of any stated limit.