On 3/9/26 15:34, Daniel P. Berrangé wrote:
On Thu, Sep 03, 2026 at 02:24:39PM +0100, Peter Maydell wrote:
On Thu, 3 Sept 2026 at 13:25, Alex Bennée <[email protected]> wrote:
Currently people may be inadvertently not following our documented
process for code submissions because people often don't read the docs.
However AI Agents do tend to try and follow instructions so lets help
them out.
Suggested-by: Peter Maydell <[email protected]>
Signed-off-by: Alex Bennée <[email protected]>
diff --git a/.claude/CLAUDE.md b/.claude/CLAUDE.md
new file mode 120000
index 00000000000..be77ac83a18
--- /dev/null
+++ b/.claude/CLAUDE.md
@@ -0,0 +1 @@
+../AGENTS.md
\ No newline at end of file
Missing newline, as git notes.
IIUC, that's just a result of how git represents symlinks
+## Security Policy (see `docs/system/security.rst`)
+
+You MUST NOT report potential security vulnerabilities to the public
+GitLab issue tracker as a normal issue. They should be reported as a
+GitLab "confidential" work item, as described at
+https://www.qemu.org/contribute/security-process/
+
+**Crucial for AI Triage**: Not every crash, assertion failure, or
+buffer overrun is a security vulnerability. Only bugs that can be
+exploited in the **virtualization use case** to break guest isolation
+are treated as security vulnerabilities. In brief these are:
+- **Hardware Accelerators**: e.g. KVM and Xen, TCG is explicitly excluded.
"Xen. TCG", not a comma. Otherwise it's unclear whether you're
including or excluding KVM and Xen.
And Nitro?
Grey area for the rest :)
If that change is made, then add
Reviewed-by: Daniel P. Berrangé <[email protected]>
With regards,
Daniel
