From b5e44ea3fdf13032fb537dc1011c6cd9c06c7b32 Mon Sep 17 00:00:00 2001 From: Classic298 <27028174+Classic298@users.noreply.github.com> Date: Sat, 13 Jun 2026 16:05:04 +0200 Subject: [PATCH] security-policy: remove Rule 14 (One Vulnerability Per Report) Redundant with the CVE Program counting rules, already incorporated via the "Alignment with the CVE Program" section. Mirrors the same removal in the open-webui SECURITY.md (patch-1). Co-Authored-By: Claude Opus 4.8 (1M context) --- docs/security/security-policy.mdx | 2 -- 1 file changed, 2 deletions(-) diff --git a/docs/security/security-policy.mdx b/docs/security/security-policy.mdx index dd508821..41f2d3bb 100644 --- a/docs/security/security-policy.mdx +++ b/docs/security/security-policy.mdx @@ -113,8 +113,6 @@ We appreciate the community's interest in identifying potential vulnerabilities. 13. **Self-Affecting Issues Are Not Vulnerabilities**: A vulnerability requires crossing a security boundary that affects **a party other than the reporter**. Crossing one of the security boundaries only against the reporter's own data, account, session, or environment is not a vulnerability — it is a bug, and belongs in the [Issue Tracker](https://github.com/open-webui/open-webui/issues), not in a security report. If the same action also affects another user, the operator, the host system, or shared resources, identify that second party clearly in the PoC. -14. **One Vulnerability Per Report**: Each report must describe a **single vulnerability**. If you have found multiple **distinct** vulnerabilities, file them as **separate reports** — one per vulnerability. A CVE identifier maps to exactly one vulnerability, so a single report bundling two or more distinct flaws **cannot be assigned a CVE** even when the individual findings are valid; GitHub will decline the CVE request. Bundling therefore actively prevents us from crediting and publishing your work. - Non-compliant submissions may be closed, and repeat or extreme violators may be banned. Our goal is to foster a constructive reporting environment where quality submissions promote better security for all users. ## What a Valid Report Gets You