On Sun, Aug 02, 2026 at 10:35:35PM +0200, Willy Tarreau wrote: > While vulnerability reporters have now started CCing maintainers, > showing they read the docs, the security team still spends a lot of > time repeating the same comments about tested version, incomplete > fixes, poor email client setup causing formatting issues making > patches unusable, unverified reports and missing Assisted-By tags, > each time for AI-assisted reports. > > This series adds small updates to security-bugs.rst, threat-model.rst > and coding-assistant.rst to better deal with this and provide minimal > instructions helping the LLM follow our expectations. > > The updates were iteratively and carefully tested with 3 models, > Opus-5, Qwen3.6-27B-Architect-Polaris2-Fable-B-F451, and Gemini, > until all of them strictly followed the rules. > > It is expected to further improve the situation. > > Willy Tarreau (5): > docs: threat-model: clarify "security bug" vs "vulnerability" > docs: threat-model: move fake devices out of "non production use" > docs: security-bugs: clarify what counts as a valid version > docs: coding-assistant: explain important steps when looking for bugs > docs: security-bugs: clarify some mandatory steps for AI reports > > Documentation/process/coding-assistants.rst | 37 +++++++++++++++++++ > Documentation/process/security-bugs.rst | 26 ++++++++++++++ > Documentation/process/threat-model.rst | 39 ++++++++++++--------- > 3 files changed, 85 insertions(+), 17 deletions(-) > > -- > 2.52.0 >
All of these look great, thanks for them! I'll wait a day or two before committing them to my tree and getting them to Linus for 7.2-final to hopefully quell the onslaught of "bad" bugs being reported... greg k-h
