svn commit: r1935398 - httpd/httpd/trunk

Author: jorton
Date: Tue Jun 16 07:34:07 2026
New Revision: 1935398

Log:
* SECURITY.md: Try to be more explicit about trunk-only code.

Modified:
   httpd/httpd/trunk/SECURITY.md

Modified: httpd/httpd/trunk/SECURITY.md
==============================================================================
--- httpd/httpd/trunk/SECURITY.md	Tue Jun 16 06:42:39 2026	(r1935397)
+++ httpd/httpd/trunk/SECURITY.md	Tue Jun 16 07:34:07 2026	(r1935398)
@@ -8,9 +8,9 @@ demonstrate how an attacker can violate
 ## Supported Versions
 
 Currently the only supported version is the latest patch release of the
-`2.4.x` stable branch. Vulnerabilities which exist *only* in
-unreleased branches (such as `trunk`) may be treated as normal bug
-reports.
+`2.4.x` stable branch.  Vulnerabilities which exist *only* in
+unreleased branches (such as `trunk`) should be reported as normal bug
+reports via <https://bz.apache.org/bugzilla/enter_bug.cgi?product=Apache%20httpd-2>.
 
 ## Reporting Vulnerabilities
 
@@ -36,7 +36,8 @@ Any security vulnerability SHOULD be rep
 1. under a reasonable, supported configuration.
 2. without using third-party modules, or modules explicitly designed
   for debugging.
-3. under a standard build on a supported platform.
+3. using the *latest* released sources published via <https://httpd.apache.org/download.cgi#apache24>.
+4. under a standard build, on a supported platform.
 
 Issues which are reproducible only using instrumented builds (such as
 ASAN, or under valgrind) should be clearly explained as such.