kenmirrors/firefly-iii
1
0
Fork 0
mirror of https://github.com/firefly-iii/firefly-iii.git synced 2026-07-27 16:07:45 -07:00
Code Issues Projects Releases Wiki Activity

Clarify AI hallucinations in security reporting

Browse Source 
Reworded the third point to clarify AI hallucinations in security issues.

Signed-off-by: James Cole <james@firefly-iii.org>
This commit is contained in:
James Cole
2026-05-16 20:05:20 +02:00
committed by GitHub
parent 7bd91048ea
commit c394034876
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/security.md
+1 -1
View File
@@ -10,7 +10,7 @@ disclosure and response policy to ensure that critical issues are responsibly ha
1. Any SSRF in any user provided URL field (webhooks, ntfy, SimpleFIN, Slack). It's by design that users may set-up any URL they want, be it internal, private or non-existing.
2. Any XSS issue without a viable attack tree. If you can find a spot where Firefly III or the associated tools render unescaped data, it's not a security issue unless you can show me an actual attack that gets that data into the system.
3. Any issue that is not true. AI models have already hallucinated security issues in Firefly III, going so far as to mention function/template/file-names including line numbers and code excerpts. Those issues did not exist. The model made them up.
3. Any issue that is not true. AI models have already *hallucinated* security issues in Firefly III. They've referred to **non-existing** functions, templates and files. Including line numbers and code excerpts. Validate your findings.
## Supported versions