docs(security): exclude further instances of a root cause the same reporter already reported - #7862
Merged
Merged
Conversation
…porter already reported Exclusion 10 covers instances of a class we are actively remediating, and is worded around in-progress work: an open pull request, a public branch, a not-yet-released fix. It does not fit the case where a remediation is finished and shipped and the same reporter returns with more instances of the same root cause. Adds exclusion 12 for that case: another instance of a root cause the reporter previously reported, reached through a different parameter, endpoint or event, is awarded once under the original submission. Deliberately scoped to the reporter's own earlier report. A rule that let us decline anyone pointing out that one of our fixes was incomplete would suppress exactly the reports worth having, so independent discovery of the same class by a different researcher stays in scope and is assessed on its own merits, and genuinely distinct root causes remain separate reports. The wording also states that it applies whether or not remediation had finished, which is the gap in 10. Co-Authored-By: Claude <noreply@anthropic.com>
ArtursKadikis
approved these changes
Jul 30, 2026
ar2rsawseen
enabled auto-merge
July 30, 2026 10:12
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds exclusion 12 to
SECURITY.md.Why
Exclusion 10 covers instances of a class we are actively remediating, and its wording is built around in-progress work: "an open or in-progress pull request, a public branch, or another not-yet-released fix". It does not fit the case that keeps coming up — a remediation is finished and shipped, and the same reporter returns with further instances of the same root cause.
Leaning on 10 there is weak, because the obvious response is that nothing was in progress and the issue was closed. Exclusion 12 names the actual situation.
What it says
Three deliberate limits
Scoped to the reporter's own earlier report. A rule that let us decline anyone who points out that one of our fixes was incomplete would suppress exactly the reports worth having. Independent discovery of the same class by a different researcher stays in scope.
"Whether or not we had finished remediating" is the gap in 10, stated explicitly.
Genuinely distinct root causes remain separate reports, so this cannot be stretched into declining anything that touches a previously-touched file.
Note on applying it
This is forward-looking. A report already submitted under the current policy should be assessed against the current policy; exclusion 7 (duplicates and already-known issues, only the first actionable report is eligible) already covers a same-root-cause follow-up in the meantime.
🤖 Generated with Claude Code