[Ajedi32]

Not sure about 90 days specifically, but as far as the general principle goes, yes: https://en.wikipedia.org/wiki/Responsible_disclosure