From 7d6e0cbe43310e855eeda02d943d2ed978fd0e33 Mon Sep 17 00:00:00 2001 From: David Karnok Date: Tue, 11 Aug 2026 11:43:39 +0200 Subject: [PATCH] Update security policy with reporting guidelines Added warnings about reporting issues and AI-related exploits. --- SECURITY.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/SECURITY.md b/SECURITY.md index 10035743316..fded106604c 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -1,5 +1,9 @@ # Security Policy +:warning: Do not report memory or resource leaks as security issues or exploits. Those are bugs. Report them via [Issues](https://github.com/ReactiveX/RxJava/issues) or better yet, post a **Pull Request**. + +:information_source: with the advent of AI tools, high star projects like ours are prime target for trophy hunters. If you spam our repo with miscategorized exploits given our context, you will be banned after 1-3 warnings. + If you have discovered a security vulnerability in this project, please report it privately. **Do not disclose it as a public issue.** This gives us time to work with you to fix the issue before public exposure, reducing the chance that the exploit will be used before a patch is released. Please disclose it at [security advisory](https://github.com/ReactiveX/RxJava/security/advisories/new).