Companies have 21 days to acknowledge reports and 90 days to patch vulnerabilities; otherwise, Facebook will go public with bug details.
Article Link: https://www.zdnet.com/article/facebook-explains-how-it-will-notify-third-parties-about-bugs-in-their-products/#ftag=RSSbaffb68