This is an automated email from the ASF dual-hosted git repository. markt-asf pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/tomcat.git
commit 23f25ee5c3033ba4becb85f517555e2f66fbbe7d Author: Mark Thomas <[email protected]> AuthorDate: Tue Sep 22 19:24:41 2026 +0100 Clarify the exclusion --- SECURITY.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/SECURITY.md b/SECURITY.md index d835cb1520..41e702d3b3 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -27,7 +27,7 @@ These will be **rejected without response**: - "XSS/SQLi in my deployed application" - Your app's bug, not Tomcat's - "Manager app accessible with valid password" - Admin users are trusted - Scanner reports without actual testing - Must verify manually with working PoC -- Theoretical vulnerabilities or AI-generated reports - Must include working test case +- Theoretical vulnerabilities or AI-generated reports without a working test case - Must include working test case **Review the [security model](https://tomcat.apache.org/security-model.html) to understand what qualifies as a Tomcat vulnerability.** --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
