sepe81 commented on PR #1680: URL: https://github.com/apache/struts/pull/1680#issuecomment-4391682001
Hello @lukaszlenart, One suggestion: the pre-reporting steps, assessment checklist, and report requirements would also be useful to human researchers, not only AI agents. `SECURITY.md` could be a better place for this content — GitHub shows it on the Security tab and it would help anyone, with or without AI tooling. It would also avoid the same guidance living in two files that could go out of sync. If the content moves to `SECURITY.md`, the question is whether `AGENTS.md` is still needed. It could be dropped entirely, or replaced with a soft-link to `CLAUDE.md`, which the project already has for AI assistants. For Claude Code specifically, a `.claude/agents/vulnerability-reporter.md` subagent (the project already has several in `.claude/agents/`) could fetch `SECURITY.md` and the security bulletins at runtime and guide a researcher through the checklist interactively — more useful than a static file. Proposed structure: - **`SECURITY.md`** — gets all the pre-reporting guidance; one source of truth - **`AGENTS.md`** — dropped, or a soft-link to `CLAUDE.md` - **`.claude/agents/vulnerability-reporter.md`** — interactive Claude Code agent -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
