Branch: refs/heads/cvss-impact-from-achievable Home: https://github.com/xwiki/xwiki-dev-llm Commit: b5e78b6137a74b6aa34917972da610cd8b27733e https://github.com/xwiki/xwiki-dev-llm/commit/b5e78b6137a74b6aa34917972da610... Author: Vincent Massol <[email protected]> Date: 2026-10-12 (Mon, 12 Oct 2026) Changed paths: M xwiki/okf/processes/security-policy.md Log Message: ----------- [Misc] Tighten the CVSS impact and Attack Requirements traps * Keep the right cap bullet to the cap; state the 'score by reach' rule once, in the achievable-impact bullet. * Phrase the access-setup check in CVSS terms (setting Attack Requirements to Present) and give it its own bullet, out of the 'no XWiki best practice' one. Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]> Commit: dc31a70418839b13d567241d41267e8435129476 https://github.com/xwiki/xwiki-dev-llm/commit/dc31a70418839b13d567241d41267e... Author: Vincent Massol <[email protected]> Date: 2026-10-12 (Mon, 12 Oct 2026) Changed paths: M xwiki/okf/processes/security-policy.md Log Message: ----------- [Misc] Add the Attack Complexity trap to the CVSS scoring traps * Attack Complexity is a protection to defeat, never the privilege the attacker holds, which Privileges Required already encodes. Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]> Commit: 43ecf7f95f116bc3612d1205900c3010cc6e3f79 https://github.com/xwiki/xwiki-dev-llm/commit/43ecf7f95f116bc3612d1205900c30... Author: Vincent Massol <[email protected]> Date: 2026-10-12 (Mon, 12 Oct 2026) Changed paths: M xwiki/okf/processes/security-policy.md Log Message: ----------- Merge pull request #236 from xwiki/cvss-impact-review-fixes [Misc] Tighten the CVSS impact and Attack Requirements traps Compare: https://github.com/xwiki/xwiki-dev-llm/compare/a5a9971a30ef...43ecf7f95f11 To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-dev-llm/settings/notifications