security: make it clear about subtopics in server (#18754)

* security: make it clear about subtopics in server

* exclude DoS

diff --git a/SECURITY.md b/SECURITY.md
index dd3a78d2909949c4162bef76c5f56f3812e57fd7..9a93732318121ba5ab7fcf452fbe28a8e739cc7e 100644 (file)
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -38,7 +38,11 @@ Only vulnerabilities that fall within these parts of the project are considered
 - `src/**/*`
 - `ggml/**/*`
 - `gguf-py/**/*`
-- `tools/server/*` (note: Web UI is not covered)
+- `tools/server/*`, **excluding** the following topics:
+    - Web UI
+    - Features marked as experimental
+    - Features not recommended for use in untrusted environments (e.g., router, MCP)
+    - Bugs that can lead to Denial-of-Service attack
 
 Note that none of the topics under [Using llama.cpp securely](#using-llamacpp-securely) are considered vulnerabilities in LLaMA C++.