docs: expand out-of-scope vulnerability definitions#40332
Conversation
Add clarifications for common vulnerability report categories that fall outside our security scope to help manage high-volume reporting and align with other Apache projects: - User enumeration through API responses or timing differences - Low-impact information disclosure (versions, generic errors) - Resource exhaustion requiring authentication - Missing security headers without demonstrable exploit This reduces triage overhead while focusing on genuine architectural risks.
sha174n
requested review from
betodealmeida,
craig-rueda,
dpgaspar,
eschutho,
geido,
hainenber,
kgabryje,
mistercrunch,
nytai,
rusackas,
sadpandajoe and
villebro
as code owners
|
Bito Automatic Review Skipped - Files Excluded |
Define vulnerabilities as issues with meaningful impact beyond intended security model, allowing low-impact technical edge cases to be classified as hardening rather than vulnerabilities. This provides clearer triage criteria for boundary variations and access control edge cases.
…b.com/sha174n/superset into docs/expand-security-scope-exclusions
…ity-scope-exclusions
…ity-scope-exclusions
|
I'm fine with this doc expansion, even with AI-ish tone. Helps clarifying a bit on the plausible vulnerability reports. |
|
Bito Automatic Review Skipped – PR Already Merged |
2 participants
Summary
Adds a broader impact-based vulnerability definition and expands out-of-scope categories in SECURITY.md to improve security report triage efficiency.
Changes
New vulnerability definition: Establishes impact-based criteria focusing on meaningful threats to confidentiality, integrity, or availability beyond the intended security model.
Expanded out-of-scope categories:
Why This Change
Context
The impact-based definition allows classification of exploitable but low-impact edge cases as hardening improvements rather than CVE-worthy vulnerabilities. This approach balances security rigor with practical resource allocation.
No changes to actual security implementation - purely documentation clarification of triage practices.