diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md index d829bb7d3e..3fb506aa0c 100644 --- a/.github/PULL_REQUEST_TEMPLATE.md +++ b/.github/PULL_REQUEST_TEMPLATE.md @@ -6,10 +6,12 @@ - [ ] I've documented every `RZ_API` function and struct this PR changes. - [ ] I've added tests that prove my changes are effective (required for changes to `RZ_API`). - [ ] I've updated the [Rizin book](https://github.com/rizinorg/book) with the relevant information (if needed). +- [ ] I've used AI tools to generate fully or partially these code changes and I'm sure the changes are not copyrighted by somebody else. **Detailed description** - + ... diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 81f76d073a..16b710d1fa 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -79,6 +79,27 @@ rules to make the git history more readable and consistent: * For extra details, add an empty line and use asterisk item list below * Use present simple grammar tense (Add vs Added, Fix vs Fixed/Fixes) +## Usage of AI tools + +Following the widespread availability of large language models and generative AI, +Rizin Organization has received a growing number of changes generated partially or +entirely using such tools. Many of these are completely unusable in our codebase. +While AI tools can help to draft changes, they must not replace human understanding +and proper code modifications. + +If you use AI tools to help prepare a code change, you must: + +- **Disclose** which AI tools were used and specify what they were used for. +- **Verify** that the code compiles, works and is not copyrighted by somebody else. +- **Avoid** fabricated code, placeholder text, or references to non-existent code. + +Changes that appear to be unverified AI output will be closed without response. +Repeated low-quality submissions may result in a ban. + +We align with similar policies adopted by other major open-source projects, which have +described the flood of unverified AI-generated code changes as disruptive, counterproductive, +and a drain on limited team resources. + # Additional resources * [README.md][] diff --git a/SECURITY.md b/SECURITY.md index dbd8c8b079..70a2dea1da 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -25,3 +25,27 @@ If you have not received a reply to your email within 48 hours, or have not hear - Inform the team over the [public chats](https://rizin.re/#community) that you sent a message regarding a security issue. **Important:** Don't disclose any information regarding the issue itself in the public chats. + +## AI generated vulnerability reports + +Following the widespread availability of large language models and generative AI, +we have seen a number of security reports generated partially or entirely using +such tools. Many of these contain inaccurate, misleading, or fictitious content. +While AI tools can help draft or analyze reports, they must not replace human +understanding and review. + +If you use AI tools to help prepare a report, you must: + +- **Disclose** which AI tools were used and specify what they were used for + (analysis, writing the description, writing the exploit, etc). +- **Verify** that the issue describes a real, reproducible vulnerability + that otherwise meets these reporting guidelines. +- **Avoid** fabricated code, placeholder text, or references to non-existent code. + +Reports that appear to be unverified AI output will be closed without response. +Repeated low-quality submissions may result in a ban. + +For these reasons, we decided to align with similar policies adopted by other +major open-source projects, which have described the flood of unverified +AI-generated reports as disruptive, counterproductive, and a drain on limited +security team resources.