Coordinated disclosure runs on a norm rather than a law: a researcher reports a flaw, the vendor gets roughly ninety days, then the details become public whether or not a fix exists.

When the clock runs out

Vendors miss deadlines for mundane reasons — a fix that breaks compatibility, a release train that only moves quarterly, a maintainer who has moved on. The researcher then has to weigh user risk against pressure to publish.

Why it matters to everyone else

Published details give defenders something to work with, and give attackers the same. That trade-off is the whole argument, and it has never been settled.