Greptile Summary

This docs-only PR adds two new out-of-scope bullets to SECURITY.md classifying transient decode/base64/media-conversion resource overhead as performance/security hardening rather than GHSA-class vulnerabilities, while preserving GHSA handling for cases involving real amplification, limit bypass, crashes, persistent exhaustion, or data/boundary exposure. The policy language is internally consistent and matches the existing style of surrounding bullets.

Confidence Score: 4/5

Safe to merge — documentation-only change with no code impact and clear policy intent.

Only a P2 style issue exists: the phrase "format-conversion order" in the second new bullet is slightly ambiguous compared to the clearer "other format conversion" in the parallel first bullet. No logic, security, or correctness concerns.

No files require special attention; the single changed file is SECURITY.md.

This is a comment left during a code review.
Path: SECURITY.md
Line: 152

Comment:
**Ambiguous phrasing: "format-conversion order"**

The phrase `format-conversion order` is slightly ambiguous — it could be read as "the ordering/sequencing of format-conversion steps" rather than "format-conversion work/overhead." The parallel bullet at line 67 uses the clearer phrasing `other format conversion`, and the policy intent here is about resource overhead, not the sequence of operations.

```suggestion
- Reports whose only claim is resource overhead from decode/encode, base64 expansion, media transcoding, serialization, or other format conversion after input has already passed the applicable configured acceptance limits. We may fix these as performance/security hardening, but they are not GHSA-class vulnerabilities without demonstrated unauthenticated amplification, limit bypass, crash/process termination, persistent exhaustion, data exposure, or another documented boundary bypass.
```

How can I resolve this? If you propose a fix, please make it concise.

_{Reviews (1): Last reviewed commit: "docs: classify media decode overhead as ..." | Re-trigger Greptile}

Codex review: needs maintainer review before merge.

What this changes:

The PR adds two SECURITY.md bullets classifying transient decode/base64/media-conversion resource overhead after configured acceptance limits as performance-only rather than GHSA-class unless concrete amplification, limit bypass, crash, persistent exhaustion, exposure, or boundary bypass is shown.

Maintainer follow-up before merge:

Keep this PR open for maintainer/secops review. If accepted, resolve the wording consistency issue in SECURITY.md, then merge the docs-only policy clarification with whitespace validation.

Best possible solution:

Keep this PR open for maintainer/secops review. If accepted, resolve the wording consistency issue in SECURITY.md, then merge the docs-only policy clarification with whitespace validation.

What I checked:

• Protected open PR: GitHub API shows this PR is open, unmerged, and labeled maintainer plus size: XS; protected-label items require explicit maintainer handling rather than conservative cleanup closure. (a10b53448bb3)
• PR diff and security pass: The PR changes only SECURITY.md, adding two documentation bullets at the false-positive and out-of-scope lists; no workflows, dependencies, lockfiles, package metadata, install/build scripts, secrets handling, generated/vendor code, or executable runtime paths are changed. (SECURITY.md:67, a10b53448bb3)
• Current main does not already implement it: Current main has adjacent native-decoder dependency reachability guidance, but exact/synonym search for the proposed transient overhead/base64 decode-before-size-estimate wording returns no matches. (SECURITY.md:66, 75286ef83863)
• Secops ownership: CODEOWNERS routes /SECURITY.md and security docs to @openclaw/secops, so this security-policy classification change belongs in maintainer/secops review. (.github/CODEOWNERS:8, 75286ef83863)
• Security docs model: The gateway security docs distinguish hardening findings from demonstrated trust-boundary bypasses, which is the policy boundary this PR is trying to clarify. Public docs: docs/gateway/security/index.md. (docs/gateway/security/index.md:206, 75286ef83863)
• Feature history: git blame and git log -S show the current SECURITY.md false-positive and out-of-scope security-policy sections on main trace to Peter Steinberger's commit 77a5d82e64d1bdce09d87b3f42a56150b1b103ef. (SECURITY.md:50, 77a5d82e64d1)

Likely related people:

• steipete: Current-main blame and git log -S route the relevant SECURITY.md false-positive/out-of-scope policy sections to Peter Steinberger's 77a5d82e64d1bdce09d87b3f42a56150b1b103ef commit; this is main-branch history, not just PR authorship. (role: introduced behavior and recent maintainer; confidence: high; commits: 77a5d82e64d1; files: SECURITY.md, .github/CODEOWNERS)
• openclaw/secops: CODEOWNERS explicitly owns /SECURITY.md, /docs/security/, and /docs/gateway/security/ for security-sensitive code, config, and docs. (role: required reviewer / adjacent owner; confidence: high; files: .github/CODEOWNERS, SECURITY.md, docs/gateway/security/index.md)

Remaining risk / open question:

• Security triage wording can affect how vulnerability reports are classified, so secops/maintainer review is required even for a docs-only diff.
• The current PR head still contains the phrase format-conversion order in the later out-of-scope bullet; Greptile flagged that as potentially ambiguous compared with the clearer other format conversion wording.

Codex review notes: model gpt-5.5, reasoning high; reviewed against 75286ef83863.

PR reached MERGED while I was running the local landing flow.

• Source head at merge: a10b53448bb3178693e39d14fd2734e316acd573
• Merge commit: abaa4326d81b56da1c468190a5006365b2a49cdc
• Local prepared commit (not part of the merge because the PR had already merged): 69871d4359d0194d78f082876dbb1dcd039b06f4
• Gate attempted: pnpm lint && pnpm build && pnpm test
  • pnpm lint and pnpm build passed after installing missing deps.
  • pnpm test failed only on unrelated baseline failures reproduced on temp/landpr-74311 / current main: plugin contract dist-runtime source expectations, gateway startup config mock export, auth profile replacement, and active-memory circuit breaker expectations.
• Cleaned up the post-merge head branch that my late force-push had recreated.

Thanks @steipete!