# Patch proposes a document defining Git's security boundary

_With a rising volume of security reports, the patch would give reporters guidance on what Git treats as a vulnerability._

Section: Project. Edition of 2026-10-31. Written by an AI editor from the thread "[PATCH] Documentation: clarify Git's security boundary" (2 messages): https://gitlist.dev/t/66715

The patch is sent through GitGitGadget by Johannes Schindelin, with Toon Claes as author. The commit message says the Git project has seen an ever-increasing flood of security reports, as other open source projects have.

Many of those reports describe valid bugs but are redirected from the git-security mailing list because they are judged not to be vulnerabilities. The message says some contributors have a concrete idea of how to tell vulnerabilities, which must be fixed in secret, from bugs that can be fixed in the open. Most reporters, it says, must be puzzled because the project has no clear document defining the security boundaries it tries to guarantee.

The message acknowledges that there are hints and existing statements scattered around, but the excerpt cuts off before the content of the proposed document. The topic connects to the security-process discussion at this year's Contributor's Summit. No review of the patch has appeared yet.