diff --git a/docs/security/security-policy.mdx b/docs/security/security-policy.mdx
index dd508821..41f2d3bb 100644
--- a/docs/security/security-policy.mdx
+++ b/docs/security/security-policy.mdx
@@ -113,8 +113,6 @@ We appreciate the community's interest in identifying potential vulnerabilities.
 
 13. **Self-Affecting Issues Are Not Vulnerabilities**: A vulnerability requires crossing a security boundary that affects **a party other than the reporter**. Crossing one of the security boundaries only against the reporter's own data, account, session, or environment is not a vulnerability — it is a bug, and belongs in the [Issue Tracker](https://github.com/open-webui/open-webui/issues), not in a security report. If the same action also affects another user, the operator, the host system, or shared resources, identify that second party clearly in the PoC.
 
-14. **One Vulnerability Per Report**: Each report must describe a **single vulnerability**. If you have found multiple **distinct** vulnerabilities, file them as **separate reports** — one per vulnerability. A CVE identifier maps to exactly one vulnerability, so a single report bundling two or more distinct flaws **cannot be assigned a CVE** even when the individual findings are valid; GitHub will decline the CVE request. Bundling therefore actively prevents us from crediting and publishing your work.
-
 Non-compliant submissions may be closed, and repeat or extreme violators may be banned. Our goal is to foster a constructive reporting environment where quality submissions promote better security for all users.
 
 ## What a Valid Report Gets You