doc: explicitly ask for reproducible in JS

RafaelGSS · sxa · commit 84d05163b9a3 · 2026-06-18T21:12:35.000+01:00
Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com> PR-URL: #63479 Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com> Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com> Reviewed-By: Richard Lau <richard.lau@ibm.com> Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com> Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com> Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com>
diff --git a/SECURITY.md b/SECURITY.md
@@ -85,6 +85,7 @@ When reporting security vulnerabilities, reporters must adhere to the following
 
 4. **Report Quality**
    * Provide clear, detailed steps to reproduce the vulnerability.
+   * Include reproducible code written in JavaScript.
    * Include only the minimum proof of concept required to demonstrate the issue.
    * Remove any malicious payloads or components that could cause harm.
 
