open-webui/docs
1
0
Fork 0
mirror of https://github.com/open-webui/docs.git synced 2026-07-19 14:43:33 -04:00
Code Issues 37 Packages Projects Releases Wiki Activity

security-policy: remove Rule 14 (One Vulnerability Per Report)

Browse Source 
Redundant with the CVE Program counting rules, already incorporated via the
"Alignment with the CVE Program" section. Mirrors the same removal in the
open-webui SECURITY.md (patch-1).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Classic298
2026-06-13 16:05:04 +02:00
parent 68a60c56c7
commit b5e44ea3fd
1 changed files with 0 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/security/security-policy.mdx
-2
View File
@@ -113,8 +113,6 @@ We appreciate the community's interest in identifying potential vulnerabilities.
13. **Self-Affecting Issues Are Not Vulnerabilities**: A vulnerability requires crossing a security boundary that affects **a party other than the reporter**. Crossing one of the security boundaries only against the reporter's own data, account, session, or environment is not a vulnerability — it is a bug, and belongs in the [Issue Tracker](https://github.com/open-webui/open-webui/issues), not in a security report. If the same action also affects another user, the operator, the host system, or shared resources, identify that second party clearly in the PoC.
14. **One Vulnerability Per Report**: Each report must describe a **single vulnerability**. If you have found multiple **distinct** vulnerabilities, file them as **separate reports** — one per vulnerability. A CVE identifier maps to exactly one vulnerability, so a single report bundling two or more distinct flaws **cannot be assigned a CVE** even when the individual findings are valid; GitHub will decline the CVE request. Bundling therefore actively prevents us from crediting and publishing your work.
Non-compliant submissions may be closed, and repeat or extreme violators may be banned. Our goal is to foster a constructive reporting environment where quality submissions promote better security for all users.
## What a Valid Report Gets You