DOC: security: clarify how to send proper reports

Due to the advent of AI, reports are becoming extremely common the the
security list and seem to be competing in a race to bad quality, wasting
everyone's time and nerves. So let's clarify a few points on the expected
format and expected behavior.

Also let's fix 2 lines that were ruined by the create-release script.

diff --git a/doc/security.txt b/doc/security.txt
index 916e5ce0413cf258e8db4e0af73df3ff6af6fe32..af8ddb1257a123170f0023e7c4568a5d0f863dac 100644 (file)
--- a/doc/security.txt
+++ b/doc/security.txt
@@ -1,13 +1,13 @@
 Reporting security issues in HAProxy
 ------------------------------------
 
-Security issues may ONLY be reported against the LATEST released version 3.5
+Security issues may ONLY be reported against the LATEST released version of a
 branch, as indicated on https://www.haproxy.org/. It is the reporter's sole
 responsibility to verify that the issue exists in the upstream source code of
 the latest release for a given branch before submitting a report. Reports are
 frequently generated against older versions containing known, previously
 resolved bugs. Triaging these duplicate claims severely drains maintainer
-resources. If you are analyzing a specific version 3.5
+resources. If you are analyzing a specific version and cannot test the latest
 release, you MUST review your version's bugs at https://www.haproxy.org/bugs/
 and check the repository history to verify whether the fixes missing from that
 version address the issue. If the bug has already been resolved upstream, you
@@ -31,6 +31,15 @@ handful of security officers; anything shared there remains private. Please
 include a reproducer, and ideally a proposed and tested patch, as well as a
 valid name under which the report can be credited.
 
+Always send one e-mail per report, so that reports can be easily dispatched to
+different maintainers. Do NOT attach binary files (tar.gz, zip, pdf, ...) as
+they are impossible to read inline and quote when replying. Just join any file
+as plain text (attached or inline depending on the intended use). Do NOT send
+reports to the haproxy.com address which is handled by a different team and is
+for different products. Always use a valid e-mail address when submitting your
+report. Submissions for which the reporter doesn't respond to questions in a
+timely manner will simply be dropped.
+
 Auxiliary tools in dev/ and admin/ are not intended for production use and are
 by nature out of the security scope. Please report bugs affecting them via the
 regular channels.