Update SECURITY.md with AI vulnerabilities policy - #55
Conversation
Add section on AI assisted vulnerabilities with review process.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: cb4c0eb6b1
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| ## AI assisted "vulerabillites" | ||
| These ARE allowed, but must be properly reviewed, tested, and confirmed before sent. |
There was a problem hiding this comment.
The requirement that reports be “reviewed, tested, and confirmed before sent” does not identify who performs that review and could be read as requiring maintainer review before the reporter submits the advisory, which is impossible through the documented workflow. State explicitly that reporters must independently validate AI-generated findings before submission; while revising this section, correct the misspelled heading.
Useful? React with 👍 / 👎.
1 participant
Add section on AI assisted vulnerabilities with review process.
Change
Describe the problem and the change.
Verification
List the checks you ran.
Tests cover the changed behavior.
User-facing changes are documented.
Security-sensitive changes were reviewed for privilege, XPC, signing, and SMC impact.