+1 updates look reasonable to me On Mon, Oct 26, 2026 at 5:47 AM Joe Orton <[email protected]> wrote: > > Hi folks, > > I'm proposing some more words to head-off LLMs before/after they reach > security@ with a clearer description of the security model for specific > modules. I'd appreciate review particularly: > > 1) for mod_lua, I think we should be explicit that random module bugs > (crashes, leaks etc) are outside the security model. It is too easy for > LLMs to jump from remote unauthenticated client runs Lua script X, X has > crash/bug/leak/whatever -> vulnerability - that isn't a sensible or > sustainable model. > > 2) mod_proxy_hcheck/mod_proxy_beacon and mod_heartmonitor - is this all > correct? > > Regards, Joe
-- Eric Covener [email protected]
