doc: clarify security triage dispositions and permission boundaries

[RafaelGSS]

Clarify SECURITY.md by defining security triage dispositions, documenting same-process self-harm exclusions, and separating Permission Model reports into vulnerability, security-interest, and excluded cases. Also correct the worker_threads guidance: workers with modified execArgv or env may not inherit the parent permission configuration, while worker creation itself remains gated by --allow-worker.

[nodejs-github-bot]

Review requested:

• @nodejs/tsc

[BethGriggs]

It might just be me, but I find this line slightly hard to follow as it's written. I think the wording is easy to overlap with vulnerabilities that we reject due to requiring untrusted input.

[RafaelGSS]

Do you have a suggestion?

[BethGriggs]

Maybe something like this? But non-blocking if others prefer the original version:

Suggested change

	* **Vulnerability**: Reachable through an element Node.js does not trust and
	causes disclosure or loss of integrity or confidentiality of protected data,
	arbitrary code execution, or runtime unavailability under the DoS criteria
	described below.
	* **Vulnerability**: A Node.js defect that an untrusted party can exploit to
	disclose protected data, compromise its integrity or confidentiality, execute
	arbitrary code, or make the runtime unavailable under the DoS criteria below.

[RafaelGSS]

I’m just confused with what “protected data” means here. Someone could reasonably interpret “protected” as protected by application authorization, filesystem permissions, the Permission Model, or something else outside Node’s threat model

[BethGriggs]

Ah, I just kept that term as it was in the original

[BethGriggs]

My main confusion was with this part:

Vulnerability: Reachable through an element Node.js does not trust

But, perhaps need to rethink the whole line.

[RafaelGSS]

See: #65436 (comment)

[nodejs-github-bot]

Commit Queue failed

This pull request has multiple commits, but no landing policy was selected.

Add commit-queue-squash PRs the Commit Queue should land as one squashed commit. to land it as one commit, or commit-queue-rebase PRs the Commit Queue should land as multiple self-contained commits. to land the commits separately.

The pull request was removed from the Commit Queue and labeled commit-queue-failed PRs whose Commit Queue landing failed and need manual intervention before retrying. . After resolving the failure, remove that label and add commit-queue PRs queued for automated landing through the Commit Queue. to retry.

Full Commit Queue output

- Loading data for nodejs/node/pull/65436
✔  Done loading data for nodejs/node/pull/65436
----------------------------------- PR info ------------------------------------
Title      doc: clarify security triage dispositions and permission boundaries (#65436)
Author     Rafael Gonzaga <rafael.nunu@hotmail.com> (@RafaelGSS)
Branch     RafaelGSS:security-triage-permission-boundaries -> nodejs:main
Labels     doc, author ready, commit-queue
Commits    2
 - doc: clarify security triage dispositions and permission boundaries
 - Update SECURITY.md
Committers 1
 - RafaelGSS <rafael.nunu@hotmail.com>
PR-URL: https://github.com/nodejs/node/pull/65436
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Beth Griggs <bethanyngriggs@gmail.com>
------------------------------ Generated metadata ------------------------------
PR-URL: https://github.com/nodejs/node/pull/65436
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Beth Griggs <bethanyngriggs@gmail.com>
--------------------------------------------------------------------------------
   ℹ  This PR was created on Thu, 20 Aug 2026 15:49:45 GMT
   ✔  Approvals: 4
   ✔  - James M Snell (@jasnell) (TSC): https://github.com/nodejs/node/pull/65436#pullrequestreview-4985181411
   ✔  - Rich Trott (@Trott): https://github.com/nodejs/node/pull/65436#pullrequestreview-4985423029
   ✔  - Chengzhong Wu (@legendecas) (TSC): https://github.com/nodejs/node/pull/65436#pullrequestreview-4987024577
   ✔  - Beth Griggs (@BethGriggs): https://github.com/nodejs/node/pull/65436#pullrequestreview-5029178420
   ✔  Last GitHub CI successful
   ℹ  Green GitHub CI is sufficient
--------------------------------------------------------------------------------
   ✔  No git cherry-pick in progress
   ✔  No git am in progress
   ✔  No git rebase in progress
--------------------------------------------------------------------------------
- Bringing origin/main up to date...
From https://github.com/nodejs/node
 * branch                  main       -> FETCH_HEAD
✔  origin/main is now up-to-date
- Downloading patch for 65436
From https://github.com/nodejs/node
 * branch                  refs/pull/65436/merge -> FETCH_HEAD
✔  Fetched commits as 49c87ef145e1..470829efa225
--------------------------------------------------------------------------------
[main 318ae7849c] doc: clarify security triage dispositions and permission boundaries
 Author: RafaelGSS <rafael.nunu@hotmail.com>
 Date: Thu Aug 20 12:48:56 2026 -0300
 1 file changed, 58 insertions(+), 3 deletions(-)
[main 5493251280] Update SECURITY.md
 Author: Rafael Gonzaga <rafael.nunu@hotmail.com>
 Date: Tue Aug 25 14:20:49 2026 -0300
 1 file changed, 4 insertions(+), 4 deletions(-)
   ✔  Patches applied
There are 2 commits in the PR. Attempting autorebase.
(node:409) [DEP0190] DeprecationWarning: Passing args to a child process with shell option true can lead to security vulnerabilities, as the arguments are not escaped, only concatenated.
(Use `node --trace-deprecation ...` to show where the warning was created)
Rebasing (2/4)
Executing: git node land --amend --yes
--------------------------------- New Message ----------------------------------
doc: clarify security triage dispositions and permission boundaries

Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
PR-URL: https://github.com/nodejs/node/pull/65436
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Beth Griggs <bethanyngriggs@gmail.com>
--------------------------------------------------------------------------------
[detached HEAD 55668d568c] doc: clarify security triage dispositions and permission boundaries
 Author: RafaelGSS <rafael.nunu@hotmail.com>
 Date: Thu Aug 20 12:48:56 2026 -0300
 1 file changed, 58 insertions(+), 3 deletions(-)
Rebasing (3/4)
Rebasing (4/4)
Executing: git node land --amend --yes
--------------------------------- New Message ----------------------------------
Update SECURITY.md

PR-URL: https://github.com/nodejs/node/pull/65436
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Beth Griggs <bethanyngriggs@gmail.com>
--------------------------------------------------------------------------------
[detached HEAD 88875d02df] Update SECURITY.md
 Author: Rafael Gonzaga <rafael.nunu@hotmail.com>
 Date: Tue Aug 25 14:20:49 2026 -0300
 1 file changed, 4 insertions(+), 4 deletions(-)
Successfully rebased and updated refs/heads/main.
--------------------------------------------------------------------------------
   ℹ  Add `commit-queue-squash` label to land the PR as one commit, or `commit-queue-rebase` to land as separate commits.

View workflow run

[nodejs-github-bot]

Landed in a020ac4