Which one of the following approaches would be the most responsible way for him to share this knowledge in the situation that Alan recently discovered a new vulnerability in a popular office productivity suite?

A Notify the vendor about the vulnerability and provide a 90-day waiting period before public disclosure.

explanation