Ledger CTO Charles Guillemet noted that artificial intelligence has simplified the process of identifying and exploiting software bugs. He criticized researchers who publish vulnerability details before vendors can implement fixes, describing this behavior as attention farming at the expense of user risk.
Guillemet proposed that researchers report bugs privately and establish a mutually agreed timeline for remediation. He mentioned 90 days as a standard default window for these fixes, though the duration may vary based on the flaw's severity and the complexity of the required work.
Trezor's head of security, Jan Komárek, emphasized that the 90-day window is a commitment from the vendor to the researcher. He urged researchers to contact the company first and agree on a timeline, noting that findings should be published regardless if the vendor fails to deliver a fix within that period.
The call for responsible disclosure follows significant security incidents in the hardware wallet sector. These include thefts exceeding $100 million from Coldcard and a data breach at a Trezor shipping provider that exposed the personal information of tens of thousands of customers.