Branch: refs/heads/cvss-source-mandate Home: https://github.com/xwiki/xwiki-dev-llm Commit: b3bef903eddec1d0b968f2adff6a7e1dc54d8396 https://github.com/xwiki/xwiki-dev-llm/commit/b3bef903eddec1d0b968f2adff6a7e... Author: Vincent Massol <[email protected]> Date: 2026-09-03 (Thu, 03 Sep 2026) Changed paths: M xwiki/okf/index.md M xwiki/okf/processes/security-policy.md Log Message: ----------- [Misc] Take every CVSS metric from the security policy instead of scoring from memory The scoring section listed a subset of the policy's rules and only asked for a re-read "when the exact scoring matters", which is weak enough that a score can be computed from generic CVSS instinct and still look policy-compliant. * Make reading the policy's "Best practices for computing CVSS" section mandatory before setting a vector, and link that section's anchor directly rather than the page. * Carry the rules that were missing and that generic instinct gets wrong: Attack Vector is always Network; XSS fixes the subsequent-system impacts (C/I Low, A None) as well as the vulnerable-system ones, so high subsequent impact asserts code execution and has to be established; the Script-right caveat drops all impacts to Low and is about the right the attack needs, not the one it yields; Attack Complexity, Attack Requirements and User Interaction have no XWiki best practice, and viewing a page is passive interaction. * Reword the verify recipe to say the values must not be scored from, replacing the softer "do not quote as gospel", and fold the calculator sentence into the new lead-in. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-dev-llm/settings/notifications