Facebook explains how it will notify third-parties about bugs in their products

Companies have 21 days to acknowledge reports and 90 days to patch vulnerabilities; otherwise, Facebook will go public with bug details.