docs: security-bugs: clarify some mandatory steps for AI reports

The security team is still seeing a lot of reports lacking a full patch
and showing missing contents and formatting issues. Since AI assistants
tend to be better than humans at following instructions, let's defer to
coding-assistants.rst to follow mandatory steps, and insist on the plain
text format, as well as asking for recipient addresses and an e-mail
client setup hint to be mentioned early in the report for the reporter.

Also add a link to https://github.com/masoncl/kres.git which contains
way more advanced and detailed steps for those willing to go further.

Tested with Opus-5 and Qwen3.6-27B-Architect-Polaris2-Fable-B-F451, both
of which proceeded according to instructions.

Cc: Greg KH <greg@kroah.com>
Cc: Chris Mason <clm@meta.com>
Signed-off-by: Willy Tarreau <w@1wt.eu>
Link: https://patch.msgid.link/20260802203540.3453-6-w@1wt.eu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/Documentation/process/security-bugs.rst b/Documentation/process/security-bugs.rst
index 6f7c21515e9ea40493b985b8ddd6f5dceeb355b8..c7dfecc87764c05e437e9ecccf6605f31907f27c 100644 (file)
--- a/Documentation/process/security-bugs.rst
+++ b/Documentation/process/security-bugs.rst
@@ -229,6 +229,28 @@ there is no need to consume a maintainer's time with an unimportant report. If
 the issue is clearly trivial and publicly discoverable, you should report it
 directly to the public mailing lists.
 
+At the very least, when using an AI assistant to find and report bugs, make the
+assistant read this file and threat-model.rst before proceeding, and have it
+follow the procedure described in coding-assistants.rst: work on an up-to-date
+mainline tree and note the commit ID, verify the bug is real, write a fix,
+build it warning-free and checkpatch-clean, commit it with a Fixes tag, and
+identify the maintainers with get_maintainer.pl.
+
+On top of that procedure, the AI assistant **MUST**:
+
+1. Prepare a plain-text report explaining the problem. It must contain the
+   four items listed at the top of this file as absolutely necessary: the
+   affected version or commit ID noted while following the procedure above,
+   the description of the problem, the reproducer or its status, and the
+   triggering conditions.
+2. Start the report with a temporary section listing the recipients' addresses
+   (maintainers+list for the patch, maintainers only for the report and
+   reproducer), and with instructions reminding the reporter to check that
+   their email client is properly setup (see email-clients.rst), and leave it
+   to the reporter to remove that temporary section.
+
+A more detailed process is covered at https://github.com/masoncl/kres.git.
+
 Sending the report
 ------------------