From 42019d8644c7bcc8cb2ecfe08a5419becb3acd72 Mon Sep 17 00:00:00 2001
From: sethforprivacy <40500387+sethforprivacy@users.noreply.github.com>
Date: Mon, 3 Aug 2026 07:22:41 -0400
Subject: [PATCH] security: require app-level vulnerability proofs

---
 docs/SECURITY.md | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/docs/SECURITY.md b/docs/SECURITY.md
index 0198e7286..b92493be5 100644
--- a/docs/SECURITY.md
+++ b/docs/SECURITY.md
@@ -30,13 +30,24 @@ security channel, so reports will not be missed.
 ### What to include
 
 - A clear description of the issue and its security impact.
-- Step-by-step reproduction, ideally with a proof of concept.
+- A working proof of concept is required. It must run directly against Cake
+  Wallet itself, using a release build or locally built version, and demonstrate
+  the reported behavior and security impact. Standalone Python code,
+  mathematical examples, or simulations that only reproduce the theory without
+  exercising Cake Wallet do not satisfy this requirement.
+- Step-by-step reproduction instructions.
 - Affected platforms (iOS, Android, macOS, Linux, Windows) and app version.
 - Affected wallet types / chains, if applicable.
 - Any relevant logs, addresses, or transaction IDs (for on-chain issues).
 
 If you used AI tooling to find or write up the report, please say so.
 
+### Communication expectations
+
+AI should not be used to generate comments when communicating with maintainers
+and other contributors. Comments are expected to be written by humans. Comments
+that are believed to be written by AI may be moderated.
+
 ## Our commitment (safe harbor)
 
 We consider security research conducted in good faith under this policy to be