From: Willy Tarreau Date: Thu, 12 Nov 2026 15:37:55 +0000 (+0100) Subject: DOC: security: clarify how to send proper reports X-Git-Tag: v3.5-dev12~17 X-Git-Url: https://git.kaiwu.me/%7B@url%7D?a=commitdiff_plain;h=2f9476dc46fda926b032313f33a41887b3738625;p=haproxy.git DOC: security: clarify how to send proper reports Due to the advent of AI, reports are becoming extremely common the the security list and seem to be competing in a race to bad quality, wasting everyone's time and nerves. So let's clarify a few points on the expected format and expected behavior. Also let's fix 2 lines that were ruined by the create-release script. --- diff --git a/doc/security.txt b/doc/security.txt index 916e5ce04..af8ddb125 100644 --- a/doc/security.txt +++ b/doc/security.txt @@ -1,13 +1,13 @@ Reporting security issues in HAProxy ------------------------------------ -Security issues may ONLY be reported against the LATEST released version 3.5 +Security issues may ONLY be reported against the LATEST released version of a branch, as indicated on https://www.haproxy.org/. It is the reporter's sole responsibility to verify that the issue exists in the upstream source code of the latest release for a given branch before submitting a report. Reports are frequently generated against older versions containing known, previously resolved bugs. Triaging these duplicate claims severely drains maintainer -resources. If you are analyzing a specific version 3.5 +resources. If you are analyzing a specific version and cannot test the latest release, you MUST review your version's bugs at https://www.haproxy.org/bugs/ and check the repository history to verify whether the fixes missing from that version address the issue. If the bug has already been resolved upstream, you @@ -31,6 +31,15 @@ handful of security officers; anything shared there remains private. Please include a reproducer, and ideally a proposed and tested patch, as well as a valid name under which the report can be credited. +Always send one e-mail per report, so that reports can be easily dispatched to +different maintainers. Do NOT attach binary files (tar.gz, zip, pdf, ...) as +they are impossible to read inline and quote when replying. Just join any file +as plain text (attached or inline depending on the intended use). Do NOT send +reports to the haproxy.com address which is handled by a different team and is +for different products. Always use a valid e-mail address when submitting your +report. Submissions for which the reporter doesn't respond to questions in a +timely manner will simply be dropped. + Auxiliary tools in dev/ and admin/ are not intended for production use and are by nature out of the security scope. Please report bugs affecting them via the regular channels.