{ "dataset": "AI-generated vulnerability report policy census", "version": "1.0", "license": "CC BY 4.0", "license_url": "https://creativecommons.org/licenses/by/4.0/", "attribution": "Stingrai, Who Actually Bans AI-Written Bug Reports (2026)", "canonical_page": "https://www.stingrai.io/blog/ai-generated-vulnerability-report-policies-census", "corpus_definition": "A fully enumerated, purposive frame of 53 vulnerability disclosure and bug bounty programs across three strata: 4 coordination platforms whose researcher-facing rules bind downstream programs, 20 vendor and platform programs operated by organisations shipping software or services at internet scale, and 29 open source projects that publish a security or vulnerability reporting policy. The frame was fixed before any policy text was read. This is not a probability sample of all disclosure programs, so every percentage describes this 53-program frame and nothing else.", "unit_of_observation": "The program's canonical published intake policy: the page a would-be reporter is directed to for submission rules. Policy statements published by the operator elsewhere (blog posts, program-rule announcements) are recorded separately in ai_rule_published_elsewhere_url and are not used to assign the stance code.", "retrieval_date": "2026-07-28", "cutoff_date": "2026-07-28", "recheck_cadence": "Quarterly. Next scheduled re-check: 2026-10-28.", "n": 53, "distribution_by_stance": { "conditional-human-in-the-loop": 10, "conditional-disclosure": 3, "discouraged": 3, "silent": 36, "not-publicly-accessible": 1 }, "distribution_by_stratum": { "platform": 4, "vendor": 20, "open-source": 29 }, "rubric": { "prohibited": "The policy refuses AI-assisted or AI-generated submissions outright, with no stated path to acceptance.", "conditional-disclosure": "AI-assisted submissions are permitted and acceptance is conditioned on the reporter disclosing AI use, or on naming the human who verified the finding.", "conditional-human-in-the-loop": "AI-assisted submissions are permitted and acceptance is conditioned on demonstrated human involvement: human verification, a working reproduction or proof of concept, or direct human communication. Fully autonomous or exclusively AI-written submissions are refused.", "discouraged": "The policy warns against or penalises AI-generated report content but states no condition under which such a report becomes acceptable.", "silent": "The policy makes no statement about AI-generated or AI-assisted submissions.", "ambiguous": "The policy references AI in the intake context but the operative rule cannot be determined from the published text.", "not-publicly-accessible": "The policy could not be read without an account or platform membership as of the retrieval date." }, "coding_rules": [ "A clause counts only if it references AI, LLMs, generative tooling, or autonomous agents in the context of how a report is produced or submitted. Generic proof-of-concept requirements that predate and do not reference AI are not coded as AI policy.", "AI references that define the subject matter of eligible reports (for example, prompt injection scope or model hallucination exclusions) are not coded as AI submission policy.", "Exactly one stance is assigned per program, using the precedence prohibited > conditional-disclosure > conditional-human-in-the-loop > discouraged > silent. Secondary requirements are captured in the boolean columns.", "No quote, no coding. Any stance other than silent, ambiguous, or not-publicly-accessible carries a verbatim clause.", "Where a stance could not be determined, the entry is coded silent or ambiguous. It is never guessed." ], "revision_log": [ { "date": "2026-07-28", "version": "1.0", "change": "Initial release. 53 programs coded from policy text retrieved on 2026-07-28." } ], "programs": [ { "id": 1, "retrieved": "2026-07-28", "program": "HackerOne", "operator": "HackerOne", "stratum": "platform", "policy_document": "Code of Conduct", "policy_url": "https://www.hackerone.com/policies/code-of-conduct", "stance": "conditional-human-in-the-loop", "requires_disclosure_of_ai_use": false, "requires_human_verification": true, "requires_reproduction_or_poc": true, "prohibits_fully_autonomous_submission": true, "penalty_stated": true, "penalty_detail": "Conduct review and enforcement action; sanctions against hackbot operators", "program_status": "open", "ai_cited_in_status_change": false, "verbatim_clause": "Hackbots must not operate in a fully autonomous manner. We employ a “hacker-in-the-loop” model, requiring human experts to investigate, validate, and confirm all potential vulnerabilities before submitting to a Vulnerability Disclosure (VDP) or Bug Bounty Program (BBP).", "secondary_clause": "The use of AI does not change the requirement to validate findings, connect all steps in an attack chain, and provide a clear, reproducible proof-of-concept demonstrating a real vulnerability and its impact.", "ai_rule_published_elsewhere_url": "", "notes": "Policy has a dedicated 'AI-assisted Research & Submission Standards' section plus 'Use of AI in Testing' and 'Prohibited Use of AI' subsections." }, { "id": 2, "retrieved": "2026-07-28", "program": "Bugcrowd", "operator": "Bugcrowd", "stratum": "platform", "policy_document": "Researcher Code of Conduct", "policy_url": "https://www.bugcrowd.com/resources/essentials/code-of-conduct/", "stance": "conditional-human-in-the-loop", "requires_disclosure_of_ai_use": false, "requires_human_verification": true, "requires_reproduction_or_poc": true, "prohibits_fully_autonomous_submission": true, "penalty_stated": true, "penalty_detail": "Reports submitted without human review are subject to rejection", "program_status": "open", "ai_cited_in_status_change": false, "verbatim_clause": "You manually review and validate any vulnerability report you’ve created with the help of GenAI tools before submitting it. (Reports determined to have been submitted without human review are subject to rejection.)", "secondary_clause": "", "ai_rule_published_elsewhere_url": "", "notes": "Section titled 'Responsible use of GenAI tools'. Page states 'Updated Nov 25, 2025'." }, { "id": 3, "retrieved": "2026-07-28", "program": "Intigriti", "operator": "Intigriti", "stratum": "platform", "policy_document": "Community Code of Conduct", "policy_url": "https://kb.intigriti.com/en/articles/5247238-community-code-of-conduct", "stance": "conditional-disclosure", "requires_disclosure_of_ai_use": true, "requires_human_verification": true, "requires_reproduction_or_poc": true, "prohibits_fully_autonomous_submission": true, "penalty_stated": true, "penalty_detail": "Closed without response, longer validation times, possible removal from the platform", "program_status": "open", "ai_cited_in_status_change": false, "verbatim_clause": "Be open and transparent about the use of AI. Disclose when and how AI was used in your submission.", "secondary_clause": "Reports that appear to be unverified AI output, contain fabricated elements, or demonstrate a lack of technical understanding may be closed without response, subject to longer validation times and could lead to removal from the platform.", "ai_rule_published_elsewhere_url": "", "notes": "Section titled 'The use of AI'. Opens by permitting and encouraging responsible AI use." }, { "id": 4, "retrieved": "2026-07-28", "program": "YesWeHack", "operator": "YesWeHack", "stratum": "platform", "policy_document": "Platform Code of Conduct", "policy_url": "https://helpcenter.yeswehack.io/en/articles/396541-platform-code-of-conduct", "stance": "conditional-human-in-the-loop", "requires_disclosure_of_ai_use": false, "requires_human_verification": true, "requires_reproduction_or_poc": false, "prohibits_fully_autonomous_submission": false, "penalty_stated": true, "penalty_detail": "Ethical-point deduction from a 7-point score; temporary or permanent ban from the platform", "program_status": "open", "ai_cited_in_status_change": false, "verbatim_clause": "Spamming a program by submitting reports based on assumptions, AI-generated hypotheses without manual verification.", "secondary_clause": "Submitting a vulnerability report that includes findings which are of poor quality, and which have not been expertly validated, manually tested, and confirmed by the Security Researcher through reliable methods or sources.", "ai_rule_published_elsewhere_url": "", "notes": "Violation category is named 'Program spamming and AI Slop'." }, { "id": 5, "retrieved": "2026-07-28", "program": "Google and Alphabet VRP", "operator": "Google", "stratum": "vendor", "policy_document": "Google and Alphabet Vulnerability Reward Program (VRP) Rules", "policy_url": "https://bughunters.google.com/about/rules/google-friends/google-and-alphabet-vulnerability-reward-program-vrp-rules", "stance": "discouraged", "requires_disclosure_of_ai_use": false, "requires_human_verification": false, "requires_reproduction_or_poc": false, "prohibits_fully_autonomous_submission": false, "penalty_stated": true, "penalty_detail": "Report quality rated Low, applying a 0.8x multiplier to the reward amount", "program_status": "open", "ai_cited_in_status_change": false, "verbatim_clause": "Significant communication delays, incomplete or factually incorrect responses, non-technical discussions, AI slop", "secondary_clause": "", "ai_rule_published_elsewhere_url": "", "notes": "Clause sits in the 'Researcher responsiveness' row of the report-quality table, in the Low (0.8x reward amount) column." }, { "id": 6, "retrieved": "2026-07-28", "program": "Google Open Source Software VRP", "operator": "Google", "stratum": "vendor", "policy_document": "Google Open Source Software Vulnerability Reward Program Rules", "policy_url": "https://bughunters.google.com/about/rules/6521337925468160/google-open-source-software-vulnerability-reward-program-rules", "stance": "silent", "requires_disclosure_of_ai_use": false, "requires_human_verification": false, "requires_reproduction_or_poc": true, "prohibits_fully_autonomous_submission": false, "penalty_stated": false, "penalty_detail": "", "program_status": "open", "ai_cited_in_status_change": false, "verbatim_clause": "All memory corruption vulnerabilities for OT0 and OT1 tier repositories require either exact OSS-Fuzz reproduction steps (using an existing fuzz target, and including exact steps to build the image) or an already merged patch in the target repository.", "secondary_clause": "", "ai_rule_published_elsewhere_url": "https://bughunters.google.com/blog/ossvrp-rule-updates-2026", "notes": "The rules page never names AI. The AI rationale is published separately in a dated operator blog post (19 Mar 2026): 'Over the past few weeks, we’ve seen a massive surge in AI-generated reports.' Coded silent because the rubric requires the clause itself to reference AI." }, { "id": 7, "retrieved": "2026-07-28", "program": "Google AI VRP", "operator": "Google", "stratum": "vendor", "policy_document": "AI Vulnerability Reward Program Rules", "policy_url": "https://bughunters.google.com/about/rules/5222232590712832/ai-vulnerability-reward-program-rules", "stance": "discouraged", "requires_disclosure_of_ai_use": false, "requires_human_verification": false, "requires_reproduction_or_poc": false, "prohibits_fully_autonomous_submission": false, "penalty_stated": true, "penalty_detail": "Report quality rated Low, applying a 0.8x multiplier to the reward amount", "program_status": "open", "ai_cited_in_status_change": false, "verbatim_clause": "Significant communication delays, incomplete or factually incorrect responses, non-technical discussions, AI slop", "secondary_clause": "", "ai_rule_published_elsewhere_url": "", "notes": "Shares the report-quality table used by the main Google VRP rules. Other AI references on this page concern the subject matter of reports, not how reports are written." }, { "id": 8, "retrieved": "2026-07-28", "program": "Apple Security Bounty", "operator": "Apple", "stratum": "vendor", "policy_document": "Apple Security Bounty Guidelines", "policy_url": "https://security.apple.com/bounty/guidelines/", "stance": "conditional-human-in-the-loop", "requires_disclosure_of_ai_use": false, "requires_human_verification": true, "requires_reproduction_or_poc": true, "prohibits_fully_autonomous_submission": true, "penalty_stated": true, "penalty_detail": "Report processing paused for 180 days; more than two paused periods may mean permanent removal from the program", "program_status": "open", "ai_cited_in_status_change": false, "verbatim_clause": "Infeasible reports, such as reports of theoretical issues or issues discovered by AI without proper validation.", "secondary_clause": "We receive many reports claiming to be about serious security or privacy issues, but that are generated by LLMs and submitted without the required proof or validation by a person.", "ai_rule_published_elsewhere_url": "", "notes": "Guidelines also instruct reporters to 'Avoid lengthy descriptions generated by AI tools.' Paused researchers are ineligible for rewards or advisory credit." }, { "id": 9, "retrieved": "2026-07-28", "program": "GitLab", "operator": "GitLab", "stratum": "vendor", "policy_document": "GitLab bug bounty program policy (HackerOne)", "policy_url": "https://hackerone.com/gitlab", "stance": "conditional-human-in-the-loop", "requires_disclosure_of_ai_use": false, "requires_human_verification": true, "requires_reproduction_or_poc": true, "prohibits_fully_autonomous_submission": false, "penalty_stated": true, "penalty_detail": "Closed as N/A without further investigation; not counted as the original submission for duplicate handling", "program_status": "open", "ai_cited_in_status_change": false, "verbatim_clause": "Due to an increase in low-quality AI-generated submissions, all reports must include one of the following reproduction artifacts: screen captures, videos, and logs showing vulnerabilities against your own GitLab installation.", "secondary_clause": "AI generated or assisted reports that include static code analysis without providing clear proof of exploitability and demonstrating practical security impact will not be accepted.", "ai_rule_published_elsewhere_url": "", "notes": "Policy also states that AI hallucination reports, such as an AI suggesting a package that does not exist, will not be accepted going forward." }, { "id": 10, "retrieved": "2026-07-28", "program": "Cloudflare", "operator": "Cloudflare", "stratum": "vendor", "policy_document": "Cloudflare bug bounty program policy (HackerOne)", "policy_url": "https://hackerone.com/cloudflare", "stance": "conditional-human-in-the-loop", "requires_disclosure_of_ai_use": false, "requires_human_verification": true, "requires_reproduction_or_poc": true, "prohibits_fully_autonomous_submission": false, "penalty_stated": false, "penalty_detail": "", "program_status": "open", "ai_cited_in_status_change": false, "verbatim_clause": "Researchers are welcome to use AI tools to assist their research, but the final report must demonstrate that the researcher understands the vulnerability, has verified the claims, and has produced a working reproduction.", "secondary_clause": "Proofs of concept must be human-readable and independently verifiable by a security engineer without requiring specialized tooling, deobfuscation, or reverse engineering of the PoC itself.", "ai_rule_published_elsewhere_url": "", "notes": "Section is headed 'AI-generated and low-effort reports'. The separate cloudflare.com/disclosure VDP page carries no AI clause." }, { "id": 11, "retrieved": "2026-07-28", "program": "Internet Bug Bounty", "operator": "HackerOne (community-funded)", "stratum": "vendor", "policy_document": "Internet Bug Bounty program policy (HackerOne)", "policy_url": "https://hackerone.com/ibb", "stance": "silent", "requires_disclosure_of_ai_use": false, "requires_human_verification": false, "requires_reproduction_or_poc": false, "prohibits_fully_autonomous_submission": false, "penalty_stated": false, "penalty_detail": "", "program_status": "paused", "ai_cited_in_status_change": true, "verbatim_clause": "The discovery landscape is changing. AI-assisted research is expanding vulnerability discovery across the ecosystem, increasing both coverage and speed. The balance between findings and remediation capacity in open source has substantively shifted.", "secondary_clause": "Internet Bug Bounty is taking a break and is not accepting new submissions.", "ai_rule_published_elsewhere_url": "", "notes": "No rule governs how reports may be written, so the stance is coded silent. AI-assisted research is named as a driver of the pause, framed as expanded discovery outstripping remediation capacity rather than as low-quality output." }, { "id": 12, "retrieved": "2026-07-28", "program": "GitHub Security Bug Bounty", "operator": "GitHub", "stratum": "vendor", "policy_document": "GitHub Security Bug Bounty program page", "policy_url": "https://bounty.github.com/", "stance": "silent", "requires_disclosure_of_ai_use": false, "requires_human_verification": false, "requires_reproduction_or_poc": false, "prohibits_fully_autonomous_submission": false, "penalty_stated": false, "penalty_detail": "", "program_status": "open", "ai_cited_in_status_change": false, "verbatim_clause": "", "secondary_clause": "", "ai_rule_published_elsewhere_url": "https://github.blog/security/raising-the-bar-quality-shared-responsibility-and-the-future-of-githubs-bug-bounty-program/", "notes": "The program page carries no AI clause. Two dated operator posts do: 15 May 2026 ('No matter what tools you use (scanners, static analysis, AI assistants), you need to validate the output before submitting.') and 22 Jul 2026 ('To reduce the volume of low-effort and AI-generated reports, we’re implementing a HackerOne signal requirement on the public program.')." }, { "id": 13, "retrieved": "2026-07-28", "program": "Microsoft MSRC", "operator": "Microsoft", "stratum": "vendor", "policy_document": "Microsoft Bounty Programs", "policy_url": "https://www.microsoft.com/en-us/msrc/bounty", "stance": "silent", "requires_disclosure_of_ai_use": false, "requires_human_verification": false, "requires_reproduction_or_poc": false, "prohibits_fully_autonomous_submission": false, "penalty_stated": false, "penalty_detail": "", "program_status": "open", "ai_cited_in_status_change": false, "verbatim_clause": "", "secondary_clause": "", "ai_rule_published_elsewhere_url": "", "notes": "" }, { "id": 14, "retrieved": "2026-07-28", "program": "Meta Bug Bounty", "operator": "Meta", "stratum": "vendor", "policy_document": "Meta Bug Bounty program terms", "policy_url": "https://bugbounty.meta.com/terms/", "stance": "silent", "requires_disclosure_of_ai_use": false, "requires_human_verification": false, "requires_reproduction_or_poc": false, "prohibits_fully_autonomous_submission": false, "penalty_stated": false, "penalty_detail": "", "program_status": "open", "ai_cited_in_status_change": false, "verbatim_clause": "", "secondary_clause": "", "ai_rule_published_elsewhere_url": "", "notes": "AI appears only as a scope item (Meta AI), not as a rule about how reports are written." }, { "id": 15, "retrieved": "2026-07-28", "program": "Mozilla", "operator": "Mozilla", "stratum": "vendor", "policy_document": "Client Bug Bounty Program", "policy_url": "https://www.mozilla.org/en-US/security/client-bug-bounty/", "stance": "silent", "requires_disclosure_of_ai_use": false, "requires_human_verification": false, "requires_reproduction_or_poc": false, "prohibits_fully_autonomous_submission": false, "penalty_stated": false, "penalty_detail": "", "program_status": "open", "ai_cited_in_status_change": false, "verbatim_clause": "", "secondary_clause": "", "ai_rule_published_elsewhere_url": "", "notes": "The Web and Client bug bounty pages were both checked; neither mentions AI." }, { "id": 16, "retrieved": "2026-07-28", "program": "Amazon Web Services", "operator": "Amazon", "stratum": "vendor", "policy_document": "AWS Vulnerability Reporting", "policy_url": "https://aws.amazon.com/security/vulnerability-reporting/", "stance": "silent", "requires_disclosure_of_ai_use": false, "requires_human_verification": false, "requires_reproduction_or_poc": false, "prohibits_fully_autonomous_submission": false, "penalty_stated": false, "penalty_detail": "", "program_status": "open", "ai_cited_in_status_change": false, "verbatim_clause": "", "secondary_clause": "", "ai_rule_published_elsewhere_url": "", "notes": "" }, { "id": 17, "retrieved": "2026-07-28", "program": "Shopify", "operator": "Shopify", "stratum": "vendor", "policy_document": "Shopify bug bounty program policy (HackerOne)", "policy_url": "https://hackerone.com/shopify", "stance": "silent", "requires_disclosure_of_ai_use": false, "requires_human_verification": false, "requires_reproduction_or_poc": false, "prohibits_fully_autonomous_submission": false, "penalty_stated": false, "penalty_detail": "", "program_status": "open", "ai_cited_in_status_change": false, "verbatim_clause": "", "secondary_clause": "", "ai_rule_published_elsewhere_url": "", "notes": "Program page states 'Last updated on February 10, 2026'." }, { "id": 18, "retrieved": "2026-07-28", "program": "Dropbox", "operator": "Dropbox", "stratum": "vendor", "policy_document": "Dropbox bug bounty program brief (Intigriti)", "policy_url": "https://app.intigriti.com/programs/dropbox/dropbox", "stance": "not-publicly-accessible", "requires_disclosure_of_ai_use": null, "requires_human_verification": null, "requires_reproduction_or_poc": null, "prohibits_fully_autonomous_submission": null, "penalty_stated": null, "penalty_detail": "", "program_status": "open", "ai_cited_in_status_change": false, "verbatim_clause": "", "secondary_clause": "", "ai_rule_published_elsewhere_url": "", "notes": "Program brief not publicly accessible as of 2026-07-28; an Intigriti account is required to read it. The program URL was resolved from Dropbox's published security.txt. Reporters are still bound by Intigriti's public platform Code of Conduct, which is coded separately in this census." }, { "id": 19, "retrieved": "2026-07-28", "program": "Atlassian", "operator": "Atlassian", "stratum": "vendor", "policy_document": "Report a vulnerability", "policy_url": "https://www.atlassian.com/trust/security/report-a-vulnerability", "stance": "silent", "requires_disclosure_of_ai_use": false, "requires_human_verification": false, "requires_reproduction_or_poc": false, "prohibits_fully_autonomous_submission": false, "penalty_stated": false, "penalty_detail": "", "program_status": "open", "ai_cited_in_status_change": false, "verbatim_clause": "", "secondary_clause": "", "ai_rule_published_elsewhere_url": "", "notes": "Page states 'We are unable to respond to bulk reports generated by automated scanners', which predates and does not reference generative AI." }, { "id": 20, "retrieved": "2026-07-28", "program": "Adobe", "operator": "Adobe", "stratum": "vendor", "policy_document": "Adobe bug bounty program policy (HackerOne)", "policy_url": "https://hackerone.com/adobe", "stance": "silent", "requires_disclosure_of_ai_use": false, "requires_human_verification": false, "requires_reproduction_or_poc": false, "prohibits_fully_autonomous_submission": false, "penalty_stated": false, "penalty_detail": "", "program_status": "open", "ai_cited_in_status_change": false, "verbatim_clause": "", "secondary_clause": "", "ai_rule_published_elsewhere_url": "", "notes": "Program page states 'Last updated on July 6, 2026' and includes an AI Bonus Tier. All AI references concern AI products in scope, not how reports are written." }, { "id": 21, "retrieved": "2026-07-28", "program": "Canonical (Ubuntu)", "operator": "Canonical", "stratum": "vendor", "policy_document": "Ubuntu security disclosure policy", "policy_url": "https://ubuntu.com/security/disclosure-policy", "stance": "silent", "requires_disclosure_of_ai_use": false, "requires_human_verification": false, "requires_reproduction_or_poc": false, "prohibits_fully_autonomous_submission": false, "penalty_stated": false, "penalty_detail": "", "program_status": "open", "ai_cited_in_status_change": false, "verbatim_clause": "", "secondary_clause": "", "ai_rule_published_elsewhere_url": "", "notes": "" }, { "id": 22, "retrieved": "2026-07-28", "program": "OpenAI", "operator": "OpenAI", "stratum": "vendor", "policy_document": "Coordinated vulnerability disclosure policy", "policy_url": "https://openai.com/policies/coordinated-vulnerability-disclosure-policy/", "stance": "silent", "requires_disclosure_of_ai_use": false, "requires_human_verification": false, "requires_reproduction_or_poc": false, "prohibits_fully_autonomous_submission": false, "penalty_stated": false, "penalty_detail": "", "program_status": "open", "ai_cited_in_status_change": false, "verbatim_clause": "", "secondary_clause": "", "ai_rule_published_elsewhere_url": "", "notes": "The Bugcrowd program brief was also checked. Its AI references define out-of-scope model behaviour (jailbreaks, model hallucinations), not rules on how reports may be written." }, { "id": 23, "retrieved": "2026-07-28", "program": "Anthropic", "operator": "Anthropic", "stratum": "vendor", "policy_document": "Responsible Disclosure Policy", "policy_url": "https://www.anthropic.com/responsible-disclosure-policy", "stance": "silent", "requires_disclosure_of_ai_use": false, "requires_human_verification": false, "requires_reproduction_or_poc": false, "prohibits_fully_autonomous_submission": false, "penalty_stated": false, "penalty_detail": "", "program_status": "open", "ai_cited_in_status_change": false, "verbatim_clause": "", "secondary_clause": "", "ai_rule_published_elsewhere_url": "", "notes": "" }, { "id": 24, "retrieved": "2026-07-28", "program": "Uber", "operator": "Uber", "stratum": "vendor", "policy_document": "Uber bug bounty program policy (HackerOne)", "policy_url": "https://hackerone.com/uber", "stance": "silent", "requires_disclosure_of_ai_use": false, "requires_human_verification": false, "requires_reproduction_or_poc": false, "prohibits_fully_autonomous_submission": false, "penalty_stated": false, "penalty_detail": "", "program_status": "open", "ai_cited_in_status_change": false, "verbatim_clause": "", "secondary_clause": "", "ai_rule_published_elsewhere_url": "", "notes": "The only LLM reference sets scope for token-consumption reports, not rules on how reports are written." }, { "id": 25, "retrieved": "2026-07-28", "program": "curl", "operator": "curl project", "stratum": "open-source", "policy_document": "Vulnerability disclosure policy (docs/VULN-DISCLOSURE-POLICY.md)", "policy_url": "https://github.com/curl/curl/blob/master/docs/VULN-DISCLOSURE-POLICY.md", "stance": "discouraged", "requires_disclosure_of_ai_use": false, "requires_human_verification": false, "requires_reproduction_or_poc": false, "prohibits_fully_autonomous_submission": false, "penalty_stated": false, "penalty_detail": "", "program_status": "bounty-closed", "ai_cited_in_status_change": true, "verbatim_clause": "Do not lazily paste massive, AI-generated explanations; as a contributor doing this infrequently, it is your responsibility to invest a few extra minutes into making your message digestible.", "secondary_clause": "", "ai_rule_published_elsewhere_url": "https://daniel.haxx.se/blog/2026/01/26/the-end-of-the-curl-bug-bounty/", "notes": "The bounty ended 31 January 2026. Maintainer Daniel Stenberg's dated post states 'We continue to immediately ban and publicly ridicule everyone who submits AI slop to the project', a stronger rule than the one in the policy file itself. Intake continues without monetary reward via GitHub private vulnerability reporting or email." }, { "id": 26, "retrieved": "2026-07-28", "program": "Django", "operator": "Django Software Foundation", "stratum": "open-source", "policy_document": "Django security policies: AI-Assisted Reports", "policy_url": "https://docs.djangoproject.com/en/dev/internals/security/", "stance": "conditional-disclosure", "requires_disclosure_of_ai_use": true, "requires_human_verification": true, "requires_reproduction_or_poc": true, "prohibits_fully_autonomous_submission": true, "penalty_stated": true, "penalty_detail": "Closed without response; repeated low-quality submissions may result in a ban from future reporting", "program_status": "open", "ai_cited_in_status_change": false, "verbatim_clause": "Disclose which AI tools were used and specify what they were used for (analysis, writing the description, writing the exploit, etc).", "secondary_clause": "Reports that appear to be unverified AI output will be closed without response. Repeated low-quality submissions may result in a ban from future reporting.", "ai_rule_published_elsewhere_url": "", "notes": "Dedicated 'AI-Assisted Reports' subsection requiring reporters to disclose, verify, and avoid fabricated content. States that AI tools 'must not replace human understanding and review'." }, { "id": 27, "retrieved": "2026-07-28", "program": "FFmpeg", "operator": "FFmpeg project", "stratum": "open-source", "policy_document": "FFmpeg Security: Reporting vulnerabilities", "policy_url": "https://ffmpeg.org/security.html", "stance": "conditional-disclosure", "requires_disclosure_of_ai_use": true, "requires_human_verification": true, "requires_reproduction_or_poc": true, "prohibits_fully_autonomous_submission": true, "penalty_stated": false, "penalty_detail": "", "program_status": "open", "ai_cited_in_status_change": false, "verbatim_clause": "Note, we have recently seen a spike in AI generated, false positives. Make sure that what you report are real issues by careful human verification.", "secondary_clause": "Name(s) or alias(es) of the human reviewer(s) who verified the report.", "ai_rule_published_elsewhere_url": "", "notes": "The disclosure requirement is inverted relative to most policies: rather than declaring AI use, reporters must name the human who verified the finding. The policy also states 'Automated submissions are not accepted.'" }, { "id": 28, "retrieved": "2026-07-28", "program": "Linux kernel", "operator": "Linux kernel security team", "stratum": "open-source", "policy_document": "Documentation/process/security-bugs.rst: Responsible use of AI to find bugs", "policy_url": "https://www.kernel.org/doc/html/latest/process/security-bugs.html", "stance": "conditional-human-in-the-loop", "requires_disclosure_of_ai_use": false, "requires_human_verification": true, "requires_reproduction_or_poc": true, "prohibits_fully_autonomous_submission": false, "penalty_stated": false, "penalty_detail": "", "program_status": "open", "ai_cited_in_status_change": false, "verbatim_clause": "AI-based tools are often capable of generating reproducers. Please always ensure your tool provides one and test it thoroughly. If the reproducer does not work, or if the tool cannot produce one, the validity of the report should be seriously questioned.", "secondary_clause": "If you resorted to AI assistance to identify a bug, you must treat it as public. While you may have valid reasons to believe it is not, the security team's experience shows that bugs discovered this way systematically surface simultaneously across multiple researchers, often on the same day.", "ai_rule_published_elsewhere_url": "", "notes": "The most detailed AI intake policy in the corpus. A section titled 'Responsible use of AI to find bugs' sets four requirements: length, formatting (plain text), impact evaluation against the kernel threat model, and a tested reproducer. It also changes the disclosure timeline: AI-assisted findings must be treated as already public." }, { "id": 29, "retrieved": "2026-07-28", "program": "Wireshark", "operator": "Wireshark Foundation", "stratum": "open-source", "policy_document": "SECURITY.md", "policy_url": "https://github.com/wireshark/wireshark/blob/master/SECURITY.md", "stance": "conditional-human-in-the-loop", "requires_disclosure_of_ai_use": false, "requires_human_verification": true, "requires_reproduction_or_poc": false, "prohibits_fully_autonomous_submission": true, "penalty_stated": false, "penalty_detail": "", "program_status": "open", "ai_cited_in_status_change": false, "verbatim_clause": "AI-generated reports are allowed, but we require direct communication with the reporter. Agent-submitted reports are not acceptable.", "secondary_clause": "From our perspective, agent-submitted reports are just another way of externalizing costs onto open source teams, which is a terrible way to begin a conversation.", "ai_rule_published_elsewhere_url": "", "notes": "The only policy in the corpus that separates AI-generated text (allowed) from agent-submitted reports (not acceptable) as distinct categories. It also allows for AI use in language translation as an exception." }, { "id": 30, "retrieved": "2026-07-28", "program": "llama.cpp", "operator": "ggml.ai / llama.cpp maintainers", "stratum": "open-source", "policy_document": "SECURITY.md", "policy_url": "https://github.com/ggml-org/llama.cpp/blob/master/SECURITY.md", "stance": "conditional-human-in-the-loop", "requires_disclosure_of_ai_use": false, "requires_human_verification": true, "requires_reproduction_or_poc": true, "prohibits_fully_autonomous_submission": true, "penalty_stated": true, "penalty_detail": "Maintainers reserve the right to close the report if these requirements are not fulfilled", "program_status": "open", "ai_cited_in_status_change": false, "verbatim_clause": "AI is only permitted in an assistive capacity as stated in AGENTS.md. We do not accept reports that are written exclusively by AI.", "secondary_clause": "Your report must include a working Proof-of-Concept in the form of a script and/or attached files.", "ai_rule_published_elsewhere_url": "", "notes": "Requirements are stated as preconditions the reporter must meet before submitting." }, { "id": 31, "retrieved": "2026-07-28", "program": "Nextcloud", "operator": "Nextcloud", "stratum": "open-source", "policy_document": "Nextcloud program policy (HackerOne)", "policy_url": "https://hackerone.com/nextcloud", "stance": "conditional-human-in-the-loop", "requires_disclosure_of_ai_use": false, "requires_human_verification": true, "requires_reproduction_or_poc": true, "prohibits_fully_autonomous_submission": false, "penalty_stated": true, "penalty_detail": "Closed as Spam with a 10-point reputation deduction; may lead to suspension from the program", "program_status": "bounty-suspended", "ai_cited_in_status_change": true, "verbatim_clause": "We accept only issues that you have reproduced yourself, proven by screenshots. Do not submit a report before reproducing the issue. Low-effort AI-generated reports will be ignored and closed as Spam (-10 reputation) and may lead to your suspension from this program.", "secondary_clause": "Due to the large amount of AI-generated illegitimate reports, we have temporarily suspended our paid bounty program and no financial rewards will be awarded for any submissions, regardless of severity.", "ai_rule_published_elsewhere_url": "", "notes": "Program page states 'Last updated on April 22, 2026'. Intake remains open and valid reports are still triaged, fixed and credited; only monetary rewards are suspended." }, { "id": 32, "retrieved": "2026-07-28", "program": "CPython", "operator": "Python Software Foundation", "stratum": "open-source", "policy_document": "SECURITY.md", "policy_url": "https://github.com/python/cpython/blob/main/.github/SECURITY.md", "stance": "silent", "requires_disclosure_of_ai_use": false, "requires_human_verification": false, "requires_reproduction_or_poc": false, "prohibits_fully_autonomous_submission": false, "penalty_stated": false, "penalty_detail": "", "program_status": "open", "ai_cited_in_status_change": false, "verbatim_clause": "", "secondary_clause": "", "ai_rule_published_elsewhere_url": "", "notes": "" }, { "id": 33, "retrieved": "2026-07-28", "program": "Node.js", "operator": "OpenJS Foundation", "stratum": "open-source", "policy_document": "SECURITY.md", "policy_url": "https://github.com/nodejs/node/blob/main/SECURITY.md", "stance": "silent", "requires_disclosure_of_ai_use": false, "requires_human_verification": false, "requires_reproduction_or_poc": false, "prohibits_fully_autonomous_submission": false, "penalty_stated": false, "penalty_detail": "", "program_status": "open", "ai_cited_in_status_change": false, "verbatim_clause": "", "secondary_clause": "", "ai_rule_published_elsewhere_url": "", "notes": "" }, { "id": 34, "retrieved": "2026-07-28", "program": "Kubernetes", "operator": "Cloud Native Computing Foundation", "stratum": "open-source", "policy_document": "SECURITY.md", "policy_url": "https://github.com/kubernetes/kubernetes/blob/master/.github/SECURITY.md", "stance": "silent", "requires_disclosure_of_ai_use": false, "requires_human_verification": false, "requires_reproduction_or_poc": false, "prohibits_fully_autonomous_submission": false, "penalty_stated": false, "penalty_detail": "", "program_status": "open", "ai_cited_in_status_change": false, "verbatim_clause": "", "secondary_clause": "", "ai_rule_published_elsewhere_url": "", "notes": "" }, { "id": 35, "retrieved": "2026-07-28", "program": "OpenSSL", "operator": "OpenSSL Foundation", "stratum": "open-source", "policy_document": "Security Policy", "policy_url": "https://openssl-library.org/policies/general/security-policy/", "stance": "silent", "requires_disclosure_of_ai_use": false, "requires_human_verification": false, "requires_reproduction_or_poc": false, "prohibits_fully_autonomous_submission": false, "penalty_stated": false, "penalty_detail": "", "program_status": "open", "ai_cited_in_status_change": false, "verbatim_clause": "", "secondary_clause": "", "ai_rule_published_elsewhere_url": "", "notes": "OpenSSL publishes a separate AI Code and Documentation Contribution Policy, which governs code contributions rather than security report intake." }, { "id": 36, "retrieved": "2026-07-28", "program": "Rust", "operator": "Rust Foundation", "stratum": "open-source", "policy_document": "Security policy", "policy_url": "https://www.rust-lang.org/policies/security", "stance": "silent", "requires_disclosure_of_ai_use": false, "requires_human_verification": false, "requires_reproduction_or_poc": false, "prohibits_fully_autonomous_submission": false, "penalty_stated": false, "penalty_detail": "", "program_status": "open", "ai_cited_in_status_change": false, "verbatim_clause": "", "secondary_clause": "", "ai_rule_published_elsewhere_url": "", "notes": "" }, { "id": 37, "retrieved": "2026-07-28", "program": "PostgreSQL", "operator": "PostgreSQL Global Development Group", "stratum": "open-source", "policy_document": "Security reporting", "policy_url": "https://www.postgresql.org/support/security/", "stance": "silent", "requires_disclosure_of_ai_use": false, "requires_human_verification": false, "requires_reproduction_or_poc": false, "prohibits_fully_autonomous_submission": false, "penalty_stated": false, "penalty_detail": "", "program_status": "open", "ai_cited_in_status_change": false, "verbatim_clause": "", "secondary_clause": "", "ai_rule_published_elsewhere_url": "", "notes": "" }, { "id": 38, "retrieved": "2026-07-28", "program": "Ruby on Rails", "operator": "Rails core team", "stratum": "open-source", "policy_document": "Security policy", "policy_url": "https://rubyonrails.org/security", "stance": "silent", "requires_disclosure_of_ai_use": false, "requires_human_verification": false, "requires_reproduction_or_poc": false, "prohibits_fully_autonomous_submission": false, "penalty_stated": false, "penalty_detail": "", "program_status": "open", "ai_cited_in_status_change": false, "verbatim_clause": "", "secondary_clause": "", "ai_rule_published_elsewhere_url": "", "notes": "" }, { "id": 39, "retrieved": "2026-07-28", "program": "Git", "operator": "Git project", "stratum": "open-source", "policy_document": "SECURITY.md", "policy_url": "https://github.com/git/git/blob/master/SECURITY.md", "stance": "silent", "requires_disclosure_of_ai_use": false, "requires_human_verification": false, "requires_reproduction_or_poc": false, "prohibits_fully_autonomous_submission": false, "penalty_stated": false, "penalty_detail": "", "program_status": "open", "ai_cited_in_status_change": false, "verbatim_clause": "", "secondary_clause": "", "ai_rule_published_elsewhere_url": "", "notes": "" }, { "id": 40, "retrieved": "2026-07-28", "program": "WordPress", "operator": "WordPress project", "stratum": "open-source", "policy_document": "Security page", "policy_url": "https://wordpress.org/about/security/", "stance": "silent", "requires_disclosure_of_ai_use": false, "requires_human_verification": false, "requires_reproduction_or_poc": false, "prohibits_fully_autonomous_submission": false, "penalty_stated": false, "penalty_detail": "", "program_status": "open", "ai_cited_in_status_change": false, "verbatim_clause": "", "secondary_clause": "", "ai_rule_published_elsewhere_url": "", "notes": "" }, { "id": 41, "retrieved": "2026-07-28", "program": "LibreOffice", "operator": "The Document Foundation", "stratum": "open-source", "policy_document": "Security page", "policy_url": "https://www.libreoffice.org/about-us/security/", "stance": "silent", "requires_disclosure_of_ai_use": false, "requires_human_verification": false, "requires_reproduction_or_poc": false, "prohibits_fully_autonomous_submission": false, "penalty_stated": false, "penalty_detail": "", "program_status": "open", "ai_cited_in_status_change": false, "verbatim_clause": "", "secondary_clause": "", "ai_rule_published_elsewhere_url": "", "notes": "" }, { "id": 42, "retrieved": "2026-07-28", "program": "Apache Software Foundation", "operator": "Apache Software Foundation", "stratum": "open-source", "policy_document": "Security page", "policy_url": "https://www.apache.org/security/", "stance": "silent", "requires_disclosure_of_ai_use": false, "requires_human_verification": false, "requires_reproduction_or_poc": false, "prohibits_fully_autonomous_submission": false, "penalty_stated": false, "penalty_detail": "", "program_status": "open", "ai_cited_in_status_change": false, "verbatim_clause": "", "secondary_clause": "", "ai_rule_published_elsewhere_url": "", "notes": "" }, { "id": 43, "retrieved": "2026-07-28", "program": "systemd", "operator": "systemd project", "stratum": "open-source", "policy_document": "docs/SECURITY.md", "policy_url": "https://github.com/systemd/systemd/blob/main/docs/SECURITY.md", "stance": "silent", "requires_disclosure_of_ai_use": false, "requires_human_verification": false, "requires_reproduction_or_poc": false, "prohibits_fully_autonomous_submission": false, "penalty_stated": false, "penalty_detail": "", "program_status": "open", "ai_cited_in_status_change": false, "verbatim_clause": "", "secondary_clause": "", "ai_rule_published_elsewhere_url": "", "notes": "" }, { "id": 44, "retrieved": "2026-07-28", "program": "OpenSSH", "operator": "OpenBSD / OpenSSH project", "stratum": "open-source", "policy_document": "SECURITY.md", "policy_url": "https://github.com/openssh/openssh-portable/blob/master/SECURITY.md", "stance": "silent", "requires_disclosure_of_ai_use": false, "requires_human_verification": false, "requires_reproduction_or_poc": false, "prohibits_fully_autonomous_submission": false, "penalty_stated": false, "penalty_detail": "", "program_status": "open", "ai_cited_in_status_change": false, "verbatim_clause": "", "secondary_clause": "", "ai_rule_published_elsewhere_url": "", "notes": "" }, { "id": 45, "retrieved": "2026-07-28", "program": "Zephyr", "operator": "Zephyr Project", "stratum": "open-source", "policy_document": "SECURITY.md", "policy_url": "https://github.com/zephyrproject-rtos/zephyr/blob/main/.github/SECURITY.md", "stance": "silent", "requires_disclosure_of_ai_use": false, "requires_human_verification": false, "requires_reproduction_or_poc": false, "prohibits_fully_autonomous_submission": false, "penalty_stated": false, "penalty_detail": "", "program_status": "open", "ai_cited_in_status_change": false, "verbatim_clause": "", "secondary_clause": "", "ai_rule_published_elsewhere_url": "", "notes": "" }, { "id": 46, "retrieved": "2026-07-28", "program": "Envoy", "operator": "Cloud Native Computing Foundation", "stratum": "open-source", "policy_document": "SECURITY.md", "policy_url": "https://github.com/envoyproxy/envoy/blob/main/SECURITY.md", "stance": "silent", "requires_disclosure_of_ai_use": false, "requires_human_verification": false, "requires_reproduction_or_poc": false, "prohibits_fully_autonomous_submission": false, "penalty_stated": false, "penalty_detail": "", "program_status": "open", "ai_cited_in_status_change": false, "verbatim_clause": "", "secondary_clause": "", "ai_rule_published_elsewhere_url": "", "notes": "" }, { "id": 47, "retrieved": "2026-07-28", "program": "containerd", "operator": "Cloud Native Computing Foundation", "stratum": "open-source", "policy_document": "SECURITY.md", "policy_url": "https://github.com/containerd/project/blob/main/SECURITY.md", "stance": "silent", "requires_disclosure_of_ai_use": false, "requires_human_verification": false, "requires_reproduction_or_poc": false, "prohibits_fully_autonomous_submission": false, "penalty_stated": false, "penalty_detail": "", "program_status": "open", "ai_cited_in_status_change": false, "verbatim_clause": "", "secondary_clause": "", "ai_rule_published_elsewhere_url": "", "notes": "" }, { "id": 48, "retrieved": "2026-07-28", "program": "Grafana", "operator": "Grafana Labs", "stratum": "open-source", "policy_document": "SECURITY.md", "policy_url": "https://github.com/grafana/.github/blob/main/SECURITY.md", "stance": "silent", "requires_disclosure_of_ai_use": false, "requires_human_verification": false, "requires_reproduction_or_poc": false, "prohibits_fully_autonomous_submission": false, "penalty_stated": false, "penalty_detail": "", "program_status": "open", "ai_cited_in_status_change": false, "verbatim_clause": "", "secondary_clause": "", "ai_rule_published_elsewhere_url": "", "notes": "The project's public SECURITY.md is silent on AI and routes reporters to an Intigriti program page that requires an account." }, { "id": 49, "retrieved": "2026-07-28", "program": "Home Assistant", "operator": "Open Home Foundation", "stratum": "open-source", "policy_document": "Security page", "policy_url": "https://www.home-assistant.io/security/", "stance": "silent", "requires_disclosure_of_ai_use": false, "requires_human_verification": false, "requires_reproduction_or_poc": false, "prohibits_fully_autonomous_submission": false, "penalty_stated": false, "penalty_detail": "", "program_status": "open", "ai_cited_in_status_change": false, "verbatim_clause": "", "secondary_clause": "", "ai_rule_published_elsewhere_url": "", "notes": "" }, { "id": 50, "retrieved": "2026-07-28", "program": "Mastodon", "operator": "Mastodon gGmbH", "stratum": "open-source", "policy_document": "SECURITY.md", "policy_url": "https://github.com/mastodon/mastodon/blob/main/SECURITY.md", "stance": "silent", "requires_disclosure_of_ai_use": false, "requires_human_verification": false, "requires_reproduction_or_poc": false, "prohibits_fully_autonomous_submission": false, "penalty_stated": false, "penalty_detail": "", "program_status": "open", "ai_cited_in_status_change": false, "verbatim_clause": "", "secondary_clause": "", "ai_rule_published_elsewhere_url": "", "notes": "" }, { "id": 51, "retrieved": "2026-07-28", "program": "Electron", "operator": "OpenJS Foundation", "stratum": "open-source", "policy_document": "SECURITY.md", "policy_url": "https://github.com/electron/electron/blob/main/SECURITY.md", "stance": "silent", "requires_disclosure_of_ai_use": false, "requires_human_verification": false, "requires_reproduction_or_poc": false, "prohibits_fully_autonomous_submission": false, "penalty_stated": false, "penalty_detail": "", "program_status": "open", "ai_cited_in_status_change": false, "verbatim_clause": "", "secondary_clause": "", "ai_rule_published_elsewhere_url": "", "notes": "" }, { "id": 52, "retrieved": "2026-07-28", "program": "VLC", "operator": "VideoLAN", "stratum": "open-source", "policy_document": "Security page", "policy_url": "https://www.videolan.org/security/", "stance": "silent", "requires_disclosure_of_ai_use": false, "requires_human_verification": false, "requires_reproduction_or_poc": false, "prohibits_fully_autonomous_submission": false, "penalty_stated": false, "penalty_detail": "", "program_status": "open", "ai_cited_in_status_change": false, "verbatim_clause": "", "secondary_clause": "", "ai_rule_published_elsewhere_url": "", "notes": "" }, { "id": 53, "retrieved": "2026-07-28", "program": "GNOME", "operator": "GNOME Foundation", "stratum": "open-source", "policy_document": "Security Report", "policy_url": "https://security.gnome.org/", "stance": "silent", "requires_disclosure_of_ai_use": false, "requires_human_verification": false, "requires_reproduction_or_poc": false, "prohibits_fully_autonomous_submission": false, "penalty_stated": false, "penalty_detail": "", "program_status": "open", "ai_cited_in_status_change": false, "verbatim_clause": "", "secondary_clause": "", "ai_rule_published_elsewhere_url": "", "notes": "" } ] }