After going through a few reports this morning, maybe we can cherry pick some language from https://github.com/curl/curl/blob/master/docs/VULN-DISCLOSURE-POLICY.md:
e.g. When communicating in the curl project, please explain your issues or improvements briefly and clearly in your own human voice. Do not lazily paste massive, AI-generated explanations; it is your responsibility to invest a few extra minutes into making your message digestible. The maintainers review submissions constantly, and clear writing reduces their daily burden and friction. On Mon, Oct 26, 2026 at 5:47 AM Joe Orton <[email protected]> wrote: > > Hi folks, > > I'm proposing some more words to head-off LLMs before/after they reach > security@ with a clearer description of the security model for specific > modules. I'd appreciate review particularly: > > 1) for mod_lua, I think we should be explicit that random module bugs > (crashes, leaks etc) are outside the security model. It is too easy for > LLMs to jump from remote unauthenticated client runs Lua script X, X has > crash/bug/leak/whatever -> vulnerability - that isn't a sensible or > sustainable model. > > 2) mod_proxy_hcheck/mod_proxy_beacon and mod_heartmonitor - is this all > correct? > > Regards, Joe -- Eric Covener [email protected]
