Hacker News Reader

It's typically not immediately after it's fixed, but usally about a week or so, to let the majority update.

The vendor can also usually request an extension, as per the Project Zero guidelines, of I believe 1 month if they confirm to be actively working on a patch.

The goal of responsible disclosure is to help the vendor and their users' be more secure, so having a policy that is balence between the two is important to let the vendor fix it, and to not let the users be possibly hacked

It's generally not possible to release a fix without effectively disclosing the vulnerability. It's just too easy for people to deduce what the vulnerability was by looking at the patch.

The vulnerability can often be discerned from the patch. Burying it amidst lots of unrelated bogus changes and not calling out its security relevance is going to annoy your users.