Clarify intended use and vulnerability handling policy

hsbt · claude · hsbt · commit 03adb51fe17f · 2026-07-22T17:27:03.000+09:00
The README and the rdoc discouraged production use but did not say how reports are handled. State that WEBrick is intended for testing and local development and is not intended to receive traffic from untrusted sources, and that while security issues are fixed in the open through the ordinary bug fixing process, the developers do not operate a vulnerability handling process and do not request CVE IDs. ruby#199 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
diff --git a/README.md b/README.md
@@ -10,7 +10,9 @@ A WEBrick server can be composed of multiple WEBrick servers or servlets to prov
 
 WEBrick also includes tools for daemonizing a process and starting a process at a higher privilege level and dropping permissions.
 
-WEBrick is suitable for use in testing and for development.  However, while the developers of WEBrick will attempt to fix security issues, they do not encourage the use of WEBrick to serve production web applications that may be subject to hostile input.
+WEBrick is intended for use in testing and local development. It is not intended for production use, and it is not intended to receive traffic from untrusted sources.
+
+The developers of WEBrick will attempt to fix security issues, and they do so in the open, through the ordinary bug fixing process on GitHub. Because WEBrick is not intended to receive traffic from untrusted sources, the developers do not operate a vulnerability handling process for WEBrick. They do not treat reports against WEBrick as vulnerabilities and do not request CVE IDs for them.
 
 ## Installation
 
diff --git a/lib/webrick.rb b/lib/webrick.rb
@@ -17,8 +17,16 @@
 #
 # == Security
 #
-# *Warning:* WEBrick is not recommended for production.  It only implements
-# basic security checks.
+# *Warning:* WEBrick is not intended for production use.  It is intended for
+# use in testing and local development, and it is not intended to receive
+# traffic from untrusted sources.  It only implements basic security checks.
+#
+# The developers of WEBrick will attempt to fix security issues, and they do
+# so in the open, through the ordinary bug fixing process.  Because WEBrick
+# is not intended to receive traffic from untrusted sources, the developers
+# do not operate a vulnerability handling process for WEBrick.  They do not
+# treat reports against WEBrick as vulnerabilities and do not request CVE
+# IDs for them.
 #
 # == Starting an HTTP server
 #

Original file line number	Diff line number	Diff line change
`@@ -17,8 +17,16 @@`
`17`	`17`	`#`
`18`	`18`	`# == Security`
`19`	`19`	`#`
`20`		`-# Warning: WEBrick is not recommended for production. It only implements`
`21`		`-# basic security checks.`
	`20`	`+# Warning: WEBrick is not intended for production use. It is intended for`
	`21`	`+# use in testing and local development, and it is not intended to receive`
	`22`	`+# traffic from untrusted sources. It only implements basic security checks.`
	`23`	`+#`
	`24`	`+# The developers of WEBrick will attempt to fix security issues, and they do`
	`25`	`+# so in the open, through the ordinary bug fixing process. Because WEBrick`
	`26`	`+# is not intended to receive traffic from untrusted sources, the developers`
	`27`	`+# do not operate a vulnerability handling process for WEBrick. They do not`
	`28`	`+# treat reports against WEBrick as vulnerabilities and do not request CVE`
	`29`	`+# IDs for them.`
`22`	`30`	`#`
`23`	`31`	`# == Starting an HTTP server`
`24`	`32`	`#`