What is required when submitting a security vulnerability to the program?

• A. Clear steps to reproduce, impact assessment, potential mitigations, and no disclosure guidance.
• B. Clear steps to reproduce, impact assessment, potential mitigations, and non-sensitive disclosure.
• C. Personal opinions about security.
• D. Only screenshots without details.

Answer: (B)

Submitting a security vulnerability should include actionable details that let the program understand and fix the issue: clear steps to reproduce, an impact assessment, potential mitigations, and non-sensitive disclosure guidance. Clear steps to reproduce enable verification; the impact assessment communicates severity and potential consequences; the proposed mitigations give concrete fixes; non-sensitive disclosure guidance helps coordinate disclosure without exposing sensitive information publicly. Alternatives that omit disclosure guidance, rely on personal opinions, or provide only screenshots lack essential elements for proper triage and safe disclosure.