[dmtroyer]

I mean, this seems realistic. Product Security is contacted, the issue goes into some queue somewhere. Eventually it becomes a priority and the correct engineers have to be found to understand the researcher's paper and replicate the issue to their satisfaction.

[nertzy]

Here’s what could have happened:

March 20: Confirmation of receipt of issue, boilerplate response detailing expected next steps

And as far as we know, this might have actually happened! Maybe it wasn’t deemed interesting enough to include on that timeline.

[shawnz]

It actually does say confirmation of receipt, on March 19 (the same day it was submitted)