From: Daniel Stenberg <daniel@haxx.se>
Date: Fri, 26 Jun 2026 14:23:08 +0000 (+0200)
Subject: VULN-DISCLOSURE-POLICY.md: issues that should be found by tests are LOW
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=58771cf4f3f45ccce41e9309427df557c86ce81f;p=thirdparty%2Fcurl.git

VULN-DISCLOSURE-POLICY.md: issues that should be found by tests are LOW

Closes #22190
---

diff --git a/docs/VULN-DISCLOSURE-POLICY.md b/docs/VULN-DISCLOSURE-POLICY.md
index a115ee1716..847579edb5 100644
--- a/docs/VULN-DISCLOSURE-POLICY.md
+++ b/docs/VULN-DISCLOSURE-POLICY.md
@@ -183,6 +183,10 @@ trigger. Due to timing, platform requirements or the fact that options or
 protocols involved are rare etc. [Past
 example](https://curl.se/docs/CVE-2022-43552.html)
 
+Issues that are likely to be detected by basic testing are likely to not be
+considered more severe than **Low**. Users that do not test cannot be expected
+to have secure setups to begin with.
+
 ## Medium
 
 This is a security problem that is less hard than **Low** to exploit or