Security Research is a repository that hosts security advisories and proof-of-concept code for vulnerabilities discovered by Google researchers in non-Google software.
The repository addresses the need for responsible vulnerability disclosure by publishing security research findings alongside working exploits. Google's approach follows a 90-day disclosure deadline: vendors are notified immediately with full details, and findings are shared publicly after 90 days or sooner if a vendor releases a fix. This model aims to balance researcher transparency with vendor remediation time, giving the defensive community access to vulnerability information while allowing maintainers reasonable opportunity to patch.
The repository serves security researchers, vulnerability analysts, and developers who need to understand real-world attack vectors and proof-of-concept implementations. It is suited for anyone studying vulnerability patterns, evaluating their own software's security posture, or learning from Google's security research methodology. The advisories are browsable through the repository's security advisories page, making it accessible for reference and education rather than as a dependency to integrate into projects.
The project maintains a curated collection of published advisories with accompanying code, accepting contributions primarily in the form of corrections to existing patches. Development activity centers on the publication and maintenance of security research findings rather than rapid feature iteration or frequent releases.
