From c1034cd45a147e81be2a9789b8374f9057aeeb0a Mon Sep 17 00:00:00 2001 From: Alexandre Daubois Date: Tue, 8 Sep 2026 15:42:10 +0200 Subject: [PATCH] [skip ci] Add more rejected examples in SECURITY.md --- SECURITY.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/SECURITY.md b/SECURITY.md index 24801b3b4e43..b6337a80bdc4 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -36,6 +36,13 @@ are not limited to): - Malicious `unserialize()` inputs. +- Memory exhaustion from a size the input declares, where `memory_limit` + refuses the allocation and only the current request dies. + +When creating reports, please **skip** the theatrics. Drop the impact essay, +send a short reproducer with the few lines that matter, and make each point +once. This allows us to triage and respond to your report quickly. + # Vulnerability Policy Our full policy is described at