A client wants to know the exact timeframes for bugfixes, if a bug fix is logged is there a guaranteed timeframe it would be fixed within? I can't see anything on the security pages of the website, just that major security bug fixes will be issued as a 5 day notice email to people to prepare for applying the hotfix. But in this scenario how long would it typically be between logging a major security bug fix, to actually getting it published?

As soon as possible, we work with the reporter on timelines, depending on the severity of the issue. If you need to know more please email security@umbraco.com for details, and it would help to get some information on the website as well, so make sure to suggest that too.

well it's a new build website for a client that is not on umbraco yet, and they wanted the official wording on it and I just couldn't find anything on the website they would are getting an umbraco 13 lts

That's right, only critical security fixes get a 5 day heads-up period (so people can reserve time to do patching). The rest just gets fixed and a patch will come out.

ok thanks - I do think it would be useful for something to reference and provide clients