Ledger and Trezor said researchers have a responsibility to publish their findings if vendors fail to fix bugs within an agreed disclosure window.
Hardware wallet makers Ledger and Trezor called for more responsible disclosure of security vulnerabilities.
In a Monday post on X, Ledger chief technology officer Charles Guillemet said artificial intelligence has made bugs easier to find and exploit. However, some researchers are publishing their findings before fixes are available, a practice he called “attention farming with someone else’s risk.”
Guillemet urged researchers to report bugs privately and agree on a timeline for fixes before publishing details. He cited 90 days as a common default, with flexibility depending on the severity of the flaw and the work needed to fix it.
“Ninety days is a commitment on the vendor, not just on the researcher,” Jan Komárek, Trezor’s head of security, told Cointelegraph.
“Researchers: come to us first, agree a timeline, then publish in full, and if we fail to ship a fix in that window, publish anyway,” he said.
Hardware wallet security has come under scrutiny after Coldcard thefts exceeded $100 million and a data breach at Trezor’s shipping provider exposed tens of thousands of customers’ personal information.
Related: Trezor says data breach affects another 67K US customers