WARNING: THIS SITE IS A MIRROR OF GITHUB.COM / IT CANNOT LOGIN OR REGISTER ACCOUNTS / THE CONTENTS ARE PROVIDED AS-IS / THIS SITE ASSUMES NO RESPONSIBILITY FOR ANY DISPLAYED CONTENT OR LINKS / IF YOU FOUND SOMETHING MAY NOT GOOD FOR EVERYONE, CONTACT ADMIN AT ilovescratch@foxmail.com
Skip to content

Commit 22a2ad1

Browse files
authored
Update SECURITY.md
1 parent 16f785c commit 22a2ad1

File tree

1 file changed

+8
-11
lines changed

1 file changed

+8
-11
lines changed

SECURITY.md

Lines changed: 8 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -33,14 +33,11 @@ We award bounties for valid security vulnerabilities based on severity, impact,
3333

3434
The following types of issues are **not eligible** for bounty:
3535

36-
| Category | Example |
37-
| -------------------------------- | -------------------------------------------------------------------- |
38-
| Stack traces | Errors that expose stack traces without leading to a security impact |
39-
| Outdated dependencies | Reports of outdated libraries without a working exploit |
40-
| Theoretical/non-exploitable bugs | Issues that have no realistic attack vector |
41-
| Missing or weak security headers | e.g. lack of CSP, X-Frame-Options, etc. |
42-
| Rate limiting or brute force | Reports not accompanied by a viable attack or abuse scenario |
43-
| Clickjacking | Unless demonstrated with practical impact |
44-
| Self-XSS | Requires user to input and execute their own malicious code |
45-
| Open ports | Reports of open ports without an exploit or access risk |
46-
| Version disclosure | e.g. software version in HTTP headers |
36+
| Category | Example |
37+
| ----------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------- |
38+
| Non-security-impacting behavior | Behaviors that cause inconvenience but do not pose a security risk (e.g. non-impactful file or resource creation, stack traces, version disclosure) |
39+
| Outdated or unused components | Reports of outdated libraries or open ports without a viable exploit |
40+
| Non-exploitable findings | Theoretical vulnerabilities without realistic attack scenarios |
41+
| Security headers and configurations | Missing or weak HTTP headers (e.g. CSP, X-Frame-Options) |
42+
| Abuse without impact | Reports like rate-limiting, brute force, or clickjacking without demonstrated impact |
43+
| Self-inflicted vulnerabilities | Issues requiring the user to attack themselves (e.g. Self-XSS) |

0 commit comments

Comments
 (0)