On Thu, 3 Sept 2026 at 13:25, Alex Bennée <[email protected]> wrote: > > Currently people may be inadvertently not following our documented > process for code submissions because people often don't read the docs. > However AI Agents do tend to try and follow instructions so lets help > them out. > > Suggested-by: Peter Maydell <[email protected]> > Signed-off-by: Alex Bennée <[email protected]>
> diff --git a/.claude/CLAUDE.md b/.claude/CLAUDE.md > new file mode 120000 > index 00000000000..be77ac83a18 > --- /dev/null > +++ b/.claude/CLAUDE.md > @@ -0,0 +1 @@ > +../AGENTS.md > \ No newline at end of file Missing newline, as git notes. > +## Security Policy (see `docs/system/security.rst`) > + > +You MUST NOT report potential security vulnerabilities to the public > +GitLab issue tracker as a normal issue. They should be reported as a > +GitLab "confidential" work item, as described at > +https://www.qemu.org/contribute/security-process/ > + > +**Crucial for AI Triage**: Not every crash, assertion failure, or > +buffer overrun is a security vulnerability. Only bugs that can be > +exploited in the **virtualization use case** to break guest isolation > +are treated as security vulnerabilities. In brief these are: > +- **Hardware Accelerators**: e.g. KVM and Xen, TCG is explicitly excluded. "Xen. TCG", not a comma. Otherwise it's unclear whether you're including or excluding KVM and Xen. thanks -- PMM
