fix(plugin): remove conflicting reporting rule

[ianw-oai]

Summary

Remove the rule to ignore internal-only paths. It contradicts the next paragraph, which says internal exposure alone is not a reason to ignore a finding.

Changes

Delete one bullet and format the Markdown. Keep the attacker-path requirements and privileged-access exclusions.

Testing

• 121 focused tests passed.
• Prettier check passed.
• git diff --check passed.

Risk and rollout

Policy text only. No CLI or API changes.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[Copilot]

Pull request overview

Updates the attack-path analysis severity policy reference to remove a reportability suppression rule that conflicted with adjacent guidance about internal exposure not being sufficient reason to ignore a finding.

Changes:

• Removed the “internal-only / developer-only / operator-only / localhost-only … set ignore” bullet from the reportability decision section.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-08-28T05:59:30.776419Z	3109173	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.