CRA vulnerability reporting: when does the clock start?

CRA vulnerability reporting can turn on a few hours of evidence. Monday morning, 8 am. A security researcher emails your vulnerability reporting address. They have found a remote-code-execution vulnerability in one of your products. They attach working proof-of-concept code and [...]