meta: Update security policy #2029

Merged

nex merged 2 commits from nex/meta/security-policy-update into main

2026-07-21 14:19:43 +00:00

nex commented

2026-07-21 13:39:09 +00:00

Owner

Updates the security policy to better reflect how we handle reports and how to properly report acceptable issues to us.

Rationale behind being more restrictive: We are seeing an uptick in reports that are:

Completely AI generated (and the author then does not understand what they're even reporting)
Audits containing a report of 20+ vulnerabilities in one go
Reports with the sole intent of getting a CVE assigned, presumably with the intent to look good on CVs etc
Low quality, unactionable reports
Reports for issues we're already tracking, but that subsequent reporters are expecting attribution for
Reports being filed out-of-band (for example, directly on GitHub) that we are not notified about

The volume of unactionable or low-quality reports that we are receiving is increasing, and the situation is already becoming unsustainable. These changes are intended to de-incentivise reports that are being reported for the sake of being reported, rather than being reported with genuine good will to improve the project's security. We still process all reports however, as there is always a chance the worst report you've ever seen may contain an actual problem that needs addressing, and it's always better to play it safe.

Pull request checklist:

This pull request targets the main branch, and the branch is named something other than
main.
I have written an appropriate pull request title and my description is clear.
I understand I am responsible for the contents of this pull request.
I have followed the contributing guidelines:
- My contribution follows the code style, if applicable.
- I ran pre-commit checks before opening/drafting this pull request.
- I have tested my contribution (or proof-read it for documentation-only changes)
  myself, if applicable. This includes ensuring code compiles.
- My commit messages follow the commit message format and are descriptive.

Updates the security policy to better reflect how we handle reports and how to properly report acceptable issues to us. Rationale behind being more restrictive: We are seeing an uptick in reports that are: 1. Completely AI generated (and the author then does not understand what they're even reporting) 2. Audits containing a report of 20+ vulnerabilities in one go 3. Reports with the sole intent of getting a CVE assigned, presumably with the intent to look good on CVs etc 4. Low quality, unactionable reports 5. Reports for issues we're already tracking, but that subsequent reporters are expecting attribution for 6. Reports being filed out-of-band (for example, directly on GitHub) that we are not notified about The volume of unactionable or low-quality reports that we are receiving is increasing, and the situation is already becoming unsustainable. These changes are intended to de-incentivise reports that are being reported for the sake of being reported, rather than being reported with genuine good will to improve the project's security. We still process *all* reports however, as there is always a chance the worst report you've ever seen may contain an actual problem that needs addressing, and it's always better to play it safe.     **Pull request checklist:**  - [x] This pull request targets the `main` branch, and the branch is named something other than `main`. - [x] I have written an appropriate pull request title and my description is clear. - [x] I understand I am responsible for the contents of this pull request. - I have followed the [contributing guidelines][c1]: - [x] My contribution follows the [code style][c2], if applicable. - [x] I ran [pre-commit checks][c1pc] before opening/drafting this pull request. - [ ] I have [tested my contribution][c1t] (or proof-read it for documentation-only changes) myself, if applicable. This includes ensuring code compiles. - [x] My commit messages follow the [commit message format][c1cm] and are descriptive.  [c1]: https://forgejo.ellis.link/continuwuation/continuwuity/src/branch/main/CONTRIBUTING.md [c2]: https://forgejo.ellis.link/continuwuation/continuwuity/src/branch/main/docs/development/code_style.mdx [c1pc]: https://forgejo.ellis.link/continuwuation/continuwuity/src/branch/main/CONTRIBUTING.md#pre-commit-checks [c1t]: https://forgejo.ellis.link/continuwuation/continuwuity/src/branch/main/CONTRIBUTING.md#running-tests-locally [c1cm]: https://forgejo.ellis.link/continuwuation/continuwuity/src/branch/main/CONTRIBUTING.md#commit-messages

Rows
Columns