[PATCH 09/14] docs: security-bugs: reports left unanswered for 7 days will be dropped

[Willy Tarreau <w@1wt.eu>]

Between 5 and 10% of the questions or requests sent by the security
team or maintainers to reporters never receive any response. The doc
only said that such reports "may be abandoned", without any indication
of time, and team members keep collection of unresponded threads in
their boxes just due to this.

Let's say that reports for which requests remain unanswered for 7 days
will most likely be dropped. This matches the maximum embargo duration,
which is how long the security team considers it reasonable to keep an
issue private. Also remind that concurrent reports may cause the same
bug to be addressed by someone else who will then receive the credit
in this case.

Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Willy Tarreau <w@1wt.eu>
---
 Documentation/process/security-bugs.rst | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/Documentation/process/security-bugs.rst b/Documentation/process/security-bugs.rst
index 11c385630855e..f19c712bc8e7b 100644
--- a/Documentation/process/security-bugs.rst
+++ b/Documentation/process/security-bugs.rst
@@ -383,6 +383,14 @@ run additional tests.  Reports where the reporter does not respond promptly
 or cannot effectively discuss their findings may be abandoned if the
 communication does not quickly improve.
 
+In practice, a report for which questions or requests from the security team
+or the maintainers remain unanswered for 7 days will most likely be dropped.
+This matches the maximum embargo duration described below, which is how long
+the security team considers it reasonable to keep an issue private.  Given the
+number of reports handled in parallel, the same bug may also end up being fixed
+later after being reported by someone else, in which case credit can no longer
+be guaranteed.
+
 Messages sometimes get lost, especially those containing attachments or HTML.
 Since the report is private, you have no other way to know whether it was
 delivered than to ask. However, some subsystems have a long report queue, some
-- 
2.52.0