Google's Project Zero team will disclose when vulnerabilities are found in companies' products within a week, though it will still wait up to 90 days to reveal details of those bugs.