lukaszlenart opened a new pull request, #1785: URL: https://github.com/apache/struts/pull/1785
## What Strengthens `SECURITY.md` so it is explicit that **a fix is a disclosure**, not only a PoC. Two changes: 1. **New section — "Do not disclose through a pull request, commit, or issue".** Directs reporters to email `[email protected]` first and wait for the PMC to triage and agree how the fix is handled, and covers the "found it while working on an unrelated bug/PR" and "when in doubt, report privately" cases. 2. **Extended the PoC bullet in "Report Quality Rules"** to state that a fix, patch, or hardening change is a public disclosure in the same way a PoC is, cross-linking the new section. ## Why The existing disclosure rules only forbade publishing *exploit/PoC code*. A well-meaning contributor who opens a **public PR that fixes or hints at a suspected vulnerability** honestly reads those rules as satisfied — "I'm not posting a PoC, I'm hardening the code" — while the PR itself telegraphs where the weakness is, with a working roadmap, before a fixed release exists. This brings `SECURITY.md` (the human-facing canonical doc) in line with the rule already stated in `CLAUDE.md` / `AGENTS.md`: *"Never submit a PR that fixes a suspected vulnerability."* ## Scope Documentation only. `THREAT_MODEL.md` intentionally **not** changed: it delegates the reporting process to `SECURITY.md` (§1 "Reporting cross-reference", §15 "additive — does not replace SECURITY.md … reporting process"). The disclosure-channel rule is a reporting-process concern, not a scope/property/adversary statement, so it belongs only in `SECURITY.md`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
