[gcc r14-7068] SECURITY.txt: Drop "exploitable" in reference to hardening issues

[Siddhesh Poyarekar]

https://gcc.gnu.org/g:e9f2c6d260e3f07b5144d175248e2c8788857c96

commit r14-7068-ge9f2c6d260e3f07b5144d175248e2c8788857c96
Author: Siddhesh Poyarekar <siddhesh@gotplt.org>
Date:   Mon Dec 18 09:35:06 2023 -0500

    SECURITY.txt: Drop "exploitable" in reference to hardening issues
    
    The "exploitable vulnerability" may lead to a misunderstanding that
    missed hardening issues are considered vulnerabilities, just that
    they're not exploitable.  This is not true, since while hardening bugs
    may be security-relevant, the absence of hardening does not make a
    program any more vulnerable to exploits than without.
    
    Drop the "exploitable" word to make it clear that missed hardening is
    not considered a vulnerability.
    
    Signed-off-by: Siddhesh Poyarekar <siddhesh@gotplt.org>
    
    ChangeLog:
    
            * SECURITY.txt: Drop "exploitable" in the hardening section.

Diff:
---
 SECURITY.txt | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/SECURITY.txt b/SECURITY.txt
index b3e2bbfda90..126603d4c22 100644
--- a/SECURITY.txt
+++ b/SECURITY.txt
@@ -155,10 +155,10 @@ Security features implemented in GCC
     GCC implements a number of security features that reduce the impact
     of security issues in applications, such as -fstack-protector,
     -fstack-clash-protection, _FORTIFY_SOURCE and so on.  A failure of
-    these features to function perfectly in all situations is not an
-    exploitable vulnerability in itself since it does not affect the
-    correctness of programs.  Further, they're dependent on heuristics
-    and may not always have full coverage for protection.
+    these features to function perfectly in all situations is not a
+    vulnerability in itself since it does not affect the correctness of
+    programs.  Further, they're dependent on heuristics and may not
+    always have full coverage for protection.
 
     Similarly, GCC may transform code in a way that the correctness of
     the expressed algorithm is preserved, but supplementary properties