From 8a1669c76d0a3a8f1b4e42dec3deeb55634813a2 Mon Sep 17 00:00:00 2001 From: Laurent Cozic Date: Wed, 9 Sep 2026 15:14:54 +0100 Subject: [PATCH] Doc: Updated SECURITY.md with new rules for LLM-generated reports --- SECURITY.md | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/SECURITY.md b/SECURITY.md index 5dd91bfe85..3ff1e54ccd 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -1,5 +1,8 @@ # Security Policy +> [!IMPORTANT] +> Before submitting a report, please read the [Rules for reporting](#rules-for-reporting). + ## Supported Versions Only the latest version is supported with security updates. @@ -10,6 +13,24 @@ Please report vulnerabilities [through private vulnerability reporting](https:// For general opinions on what makes an app more or less secure, please use the forum. +## Rules for reporting + +Due to the large number of LLM-generated security reports, we have to put a number of rules in place. These reports are often barely reviewed by the person posting them, which makes us waste time on findings that do not hold up. + +It appears that a number of "security researchers" are not really that, and are simply trying to score as many CVEs as possible by posting to as many open source projects as possible, to see what sticks. + +As a result: + +- We only accept up to **2 active reports per person**. + +- If you post more, we may block your account and close all your reports. + +- **Check your report before submitting it.** In particular, verify that the issue is still present in the latest version, and that you have actually executed the steps your conclusion depends on. If you submit a report that turns out to be bogus, we may permanently block your account. + +- **We no longer credit reporters in the changelog.** The bulk of the work is on our side - reviewing the report, reproducing the issue, fixing it, testing it, and releasing a patch. Copying and pasting LLM output is quick. + +A report based on an LLM analysis is fine, as long as you have verified it yourself first. + ## Areas outside Joplin's Threat Model Note: we're mostly linking to Chrome's documentation since our reasoning for these exclusions is the same.