Skip to content

Update SECURITY.md with AI vulnerabilities policy #55

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
offyotto merged 1 commit into from
Aug 9, 2026
+3 −0
Merged

Update SECURITY.md with AI vulnerabilities policy #55

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions SECURITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,3 +30,6 @@ General crashes, UI bugs, feature requests, and unsupported hardware behavior sh
## Supported Versions

Only the latest public release and the current `main` branch are actively considered for security fixes.

## AI assisted "vulerabillites"
These ARE allowed, but must be properly reviewed, tested, and confirmed before sent.
Comment on lines +34 to +35

@chatgpt-codex-connector chatgpt-codex-connector Bot Aug 9, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Clarify who must validate AI-assisted reports

The requirement that reports be “reviewed, tested, and confirmed before sent” does not identify who performs that review and could be read as requiring maintainer review before the reporter submits the advisory, which is impossible through the documented workflow. State explicitly that reporters must independently validate AI-generated findings before submission; while revising this section, correct the misspelled heading.

Useful? React with 👍 / 👎.