DOC: security: clarify that only up-to-date versions may get securty reports

With the increasing rate of low-effort, AI-driven security reports,
we're seeing an increasing level of noise. Let's first clarify what's
usually obvious to developers but not necessarily to bug reporters,
which is that vulnerability reports must exclusively apply to latest
version of a branch. The goal here is to reduce the amount of time
wasted analyzing an issue to finally respond "already fixed 3 months
ago".

Let's also add the link to the bugs page to ease extra checks on the
reporter's side when they cannot re-run the scan (which usually is
the case when time slots are granted on software scanners and they're
run against an outdated version).

This must be backported where the security doc is already present.

diff --git a/doc/security.txt b/doc/security.txt
index bd218d9ec5fd657687f1bd0dbc20be76bc6510df..01c146f75c1ef09d32a1e7d9d62588bf940a58ea 100644 (file)
--- a/doc/security.txt
+++ b/doc/security.txt
@@ -1,6 +1,22 @@
 Reporting security issues in HAProxy
 ------------------------------------
 
+Security issues may ONLY be reported against the LATEST released version of a
+branch, as indicated on https://www.haproxy.org/. It is the reporter's sole
+responsibility to verify that the issue exists in the upstream source code of
+the latest release for a given branch before submitting a report. Reports are
+frequently generated against older versions containing known, previously
+resolved bugs. Triaging these duplicate claims severely drains maintainer
+resources. If you are analyzing a specific version and cannot test the latest
+release, you MUST review your version's bugs at https://www.haproxy.org/bugs/
+and check the repository history to verify whether the fixes missing from that
+version address the issue. If the bug has already been resolved upstream, you
+must update your version or identify the specific missing patch, and refrain
+from sharing your report which then brings no value.
+
+Maintainers reserve the right to silently ignore security reports for issues
+already resolved in up-to-date releases.
+
 Before reporting anything, please read doc/internals/threat-model.txt. It
 defines precisely what is and is not considered a security vulnerability in
 HAProxy. A fair number of suspected issues (and most automated or LLM-assisted