From b8226cad0edf61c601380f59ac68e57a1dc5c369 Mon Sep 17 00:00:00 2001
From: Richard Lundeen <rlundeen@microsoft.com>
Date: Tue, 1 Sep 2026 12:24:00 -0700
Subject: [PATCH 1/4] MAINT: Simplifying GUI Feedback Buttons

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 213b9228-bbd2-4dc8-a9b5-93cc6504e69c
---
 .../Feedback/FeedbackDialog.test.tsx          | 17 ++++++++--------
 .../components/Feedback/FeedbackDialog.tsx    | 13 ++++++------
 .../components/Sidebar/Navigation.test.tsx    | 20 +++++++++----------
 .../src/components/Sidebar/Navigation.tsx     | 12 -----------
 4 files changed, 26 insertions(+), 36 deletions(-)

diff --git a/frontend/src/components/Feedback/FeedbackDialog.test.tsx b/frontend/src/components/Feedback/FeedbackDialog.test.tsx
index af623815fd..809a846000 100644
--- a/frontend/src/components/Feedback/FeedbackDialog.test.tsx
+++ b/frontend/src/components/Feedback/FeedbackDialog.test.tsx
@@ -47,19 +47,20 @@ describe("FeedbackDialog", () => {
   });
 
   describe("shell", () => {
-    it("renders sensitive-info warning and links to the public repo", () => {
+    it("renders sensitive-info warning and links to the vulnerability process", () => {
       renderDialog();
 
       expect(screen.getByText("Send feedback")).toBeInTheDocument();
       const warning = screen.getByTestId("feedback-sensitive-warning");
-      expect(warning).toHaveTextContent(/public/i);
-      expect(warning).toHaveTextContent(/secrets/i);
-      expect(warning).toHaveTextContent(/credentials/i);
-      expect(warning).toHaveTextContent(/customer data/i);
-      expect(warning).toHaveTextContent(/proprietary/i);
+      expect(warning).toHaveTextContent(
+        "Feedback is filed as a public GitHub issue. Do not include secrets, credentials, customer data, model endpoints, or other confidential or proprietary information. Do not use this form to report a security vulnerability. Follow the PyRIT security reporting process instead.",
+      );
       expect(
-        screen.getByRole("link", { name: /github\.com\/microsoft\/PyRIT/i }),
-      ).toHaveAttribute("href", "https://github.com/microsoft/PyRIT/issues");
+        screen.getByRole("link", { name: /PyRIT security reporting process/i }),
+      ).toHaveAttribute(
+        "href",
+        "https://github.com/microsoft/PyRIT/security/policy",
+      );
       expect(
         screen.getByRole("link", { name: /microsoft privacy statement/i }),
       ).toHaveAttribute(
diff --git a/frontend/src/components/Feedback/FeedbackDialog.tsx b/frontend/src/components/Feedback/FeedbackDialog.tsx
index b4c64377fe..a04da3979f 100644
--- a/frontend/src/components/Feedback/FeedbackDialog.tsx
+++ b/frontend/src/components/Feedback/FeedbackDialog.tsx
@@ -247,17 +247,18 @@ export default function FeedbackDialog({ open, onClose, context }: FeedbackDialo
                 }}
               >
                 <Text className={styles.warning} data-testid="feedback-sensitive-warning">
-                  GitHub issues are public. Please do not include secrets, credentials,
-                  customer data, model endpoints, or other proprietary information. Your
-                  feedback will be filed at{' '}
+                  Feedback is filed as a public GitHub issue. Do not include secrets,
+                  credentials, customer data, model endpoints, or other confidential or
+                  proprietary information. Do not use this form to report a security
+                  vulnerability. Follow the{' '}
                   <Link
-                    href="https://github.com/microsoft/PyRIT/issues"
+                    href="https://github.com/microsoft/PyRIT/security/policy"
                     target="_blank"
                     rel="noopener noreferrer"
                   >
-                    github.com/microsoft/PyRIT
+                    PyRIT security reporting process
                   </Link>
-                  .
+                  {' '}instead.
                 </Text>
 
                 <Field label="Category" required>
diff --git a/frontend/src/components/Sidebar/Navigation.test.tsx b/frontend/src/components/Sidebar/Navigation.test.tsx
index 9a10672321..bac2181aec 100644
--- a/frontend/src/components/Sidebar/Navigation.test.tsx
+++ b/frontend/src/components/Sidebar/Navigation.test.tsx
@@ -3,7 +3,7 @@
  * Licensed under the MIT license.
  */
 
-import { fireEvent, render, screen } from "@testing-library/react";
+import { render, screen } from "@testing-library/react";
 import userEvent from "@testing-library/user-event";
 import { ThemeProvider, useTheme } from "../../hooks/useTheme";
 import Navigation from "./Navigation";
@@ -119,25 +119,25 @@ describe("Navigation", () => {
     ).toBeInTheDocument();
   });
 
-  it("renders the feedback button and forwards clicks to onOpenFeedback", () => {
+  it("renders one feedback button and forwards clicks to onOpenFeedback", async () => {
+    const user = userEvent.setup();
     const onOpenFeedback = jest.fn();
     renderWithProvider(
       <Navigation {...defaultProps} onOpenFeedback={onOpenFeedback} />
     );
 
-    const feedbackButton = screen.getByTitle("Feedback");
-    expect(feedbackButton).toBeInTheDocument();
-    fireEvent.click(feedbackButton);
+    const feedbackButtons = screen.getAllByRole("button", { name: "Feedback" });
+    expect(feedbackButtons).toHaveLength(1);
+    await user.click(feedbackButtons[0]);
     expect(onOpenFeedback).toHaveBeenCalledTimes(1);
   });
 
-  it("links to the public security policy", () => {
+  it("does not render a direct security link", () => {
     renderWithProvider(<Navigation {...defaultProps} />);
 
-    expect(screen.getByRole("link", { name: "Security" })).toHaveAttribute(
-      "href",
-      "https://github.com/microsoft/PyRIT/security/policy"
-    );
+    expect(
+      screen.queryByRole("link", { name: "Security" })
+    ).not.toBeInTheDocument();
   });
 
   it("calls onNavigate with 'history' when history button is clicked", async () => {
diff --git a/frontend/src/components/Sidebar/Navigation.tsx b/frontend/src/components/Sidebar/Navigation.tsx
index 8a19b2fe35..1a6823d736 100644
--- a/frontend/src/components/Sidebar/Navigation.tsx
+++ b/frontend/src/components/Sidebar/Navigation.tsx
@@ -15,7 +15,6 @@ import {
   HistoryRegular,
   PersonFeedbackRegular,
   WrenchRegular,
-  OpenRegular,
   WeatherMoonRegular,
   WeatherSunnyRegular,
   TargetRegular,
@@ -149,17 +148,6 @@ export default function Navigation({
         aria-label="Feedback"
         onClick={onOpenFeedback}
       />
-      <Button
-        as="a"
-        className={styles.navButton}
-        appearance="subtle"
-        icon={<OpenRegular />}
-        title="Security"
-        aria-label="Security"
-        href="https://github.com/microsoft/PyRIT/security/policy"
-        target="_blank"
-        rel="noreferrer"
-      />
       <Menu
         checkedValues={{ [THEME_MENU_NAME]: [mode] }}
         onCheckedValueChange={handleThemeChange}

From aea356a20b4536df7fea80a66199d11dfffc066a Mon Sep 17 00:00:00 2001
From: Richard Lundeen <rlundeen@microsoft.com>
Date: Tue, 1 Sep 2026 13:40:46 -0700
Subject: [PATCH 2/4] MAINT: Clarify feedback submission paths

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 213b9228-bbd2-4dc8-a9b5-93cc6504e69c
---
 .../Feedback/FeedbackDialog.test.tsx          |  7 ++--
 .../components/Feedback/FeedbackDialog.tsx    | 39 ++++++++++++-------
 2 files changed, 29 insertions(+), 17 deletions(-)

diff --git a/frontend/src/components/Feedback/FeedbackDialog.test.tsx b/frontend/src/components/Feedback/FeedbackDialog.test.tsx
index 809a846000..53bee6e815 100644
--- a/frontend/src/components/Feedback/FeedbackDialog.test.tsx
+++ b/frontend/src/components/Feedback/FeedbackDialog.test.tsx
@@ -52,9 +52,10 @@ describe("FeedbackDialog", () => {
 
       expect(screen.getByText("Send feedback")).toBeInTheDocument();
       const warning = screen.getByTestId("feedback-sensitive-warning");
-      expect(warning).toHaveTextContent(
-        "Feedback is filed as a public GitHub issue. Do not include secrets, credentials, customer data, model endpoints, or other confidential or proprietary information. Do not use this form to report a security vulnerability. Follow the PyRIT security reporting process instead.",
-      );
+      expect(warning).toHaveTextContent(/Reporting a security vulnerability\?/);
+      expect(warning).toHaveTextContent(/Use the private PyRIT security reporting process\./);
+      expect(warning).toHaveTextContent(/Other feedback is filed as a public GitHub issue\./);
+      expect(warning).toHaveTextContent(/Do not include confidential information\./);
       expect(
         screen.getByRole("link", { name: /PyRIT security reporting process/i }),
       ).toHaveAttribute(
diff --git a/frontend/src/components/Feedback/FeedbackDialog.tsx b/frontend/src/components/Feedback/FeedbackDialog.tsx
index a04da3979f..76ba075028 100644
--- a/frontend/src/components/Feedback/FeedbackDialog.tsx
+++ b/frontend/src/components/Feedback/FeedbackDialog.tsx
@@ -84,6 +84,11 @@ const useStyles = makeStyles({
     color: tokens.colorPaletteDarkOrangeForeground1,
     fontWeight: tokens.fontWeightSemibold,
   },
+  warningGroup: {
+    display: 'flex',
+    flexDirection: 'column',
+    rowGap: tokens.spacingVerticalXS,
+  },
   helper: {
     color: tokens.colorNeutralForeground3,
     fontSize: tokens.fontSizeBase200,
@@ -246,20 +251,26 @@ export default function FeedbackDialog({ open, onClose, context }: FeedbackDialo
                   handleSubmit()
                 }}
               >
-                <Text className={styles.warning} data-testid="feedback-sensitive-warning">
-                  Feedback is filed as a public GitHub issue. Do not include secrets,
-                  credentials, customer data, model endpoints, or other confidential or
-                  proprietary information. Do not use this form to report a security
-                  vulnerability. Follow the{' '}
-                  <Link
-                    href="https://github.com/microsoft/PyRIT/security/policy"
-                    target="_blank"
-                    rel="noopener noreferrer"
-                  >
-                    PyRIT security reporting process
-                  </Link>
-                  {' '}instead.
-                </Text>
+                <div
+                  className={styles.warningGroup}
+                  data-testid="feedback-sensitive-warning"
+                >
+                  <Text className={styles.warning}>
+                    Reporting a security vulnerability? Use the private{' '}
+                    <Link
+                      href="https://github.com/microsoft/PyRIT/security/policy"
+                      target="_blank"
+                      rel="noopener noreferrer"
+                    >
+                      PyRIT security reporting process
+                    </Link>
+                    .
+                  </Text>
+                  <Text className={styles.warning}>
+                    Other feedback is filed as a public GitHub issue. Do not include
+                    confidential information.
+                  </Text>
+                </div>
 
                 <Field label="Category" required>
                   <Select

From e77bba7e312e0c7d83003b487e6042ee418daa6f Mon Sep 17 00:00:00 2001
From: Richard Lundeen <rlundeen@microsoft.com>
Date: Tue, 1 Sep 2026 13:51:16 -0700
Subject: [PATCH 3/4] MAINT: Route security reports from feedback

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 213b9228-bbd2-4dc8-a9b5-93cc6504e69c
---
 .../Feedback/FeedbackDialog.test.tsx          | 102 ++++++----
 .../components/Feedback/FeedbackDialog.tsx    | 185 +++++++++++-------
 2 files changed, 180 insertions(+), 107 deletions(-)

diff --git a/frontend/src/components/Feedback/FeedbackDialog.test.tsx b/frontend/src/components/Feedback/FeedbackDialog.test.tsx
index 53bee6e815..e434d917f2 100644
--- a/frontend/src/components/Feedback/FeedbackDialog.test.tsx
+++ b/frontend/src/components/Feedback/FeedbackDialog.test.tsx
@@ -47,27 +47,17 @@ describe("FeedbackDialog", () => {
   });
 
   describe("shell", () => {
-    it("renders sensitive-info warning and links to the vulnerability process", () => {
+    it("starts without a selected feedback type or form fields", () => {
       renderDialog();
 
       expect(screen.getByText("Send feedback")).toBeInTheDocument();
-      const warning = screen.getByTestId("feedback-sensitive-warning");
-      expect(warning).toHaveTextContent(/Reporting a security vulnerability\?/);
-      expect(warning).toHaveTextContent(/Use the private PyRIT security reporting process\./);
-      expect(warning).toHaveTextContent(/Other feedback is filed as a public GitHub issue\./);
-      expect(warning).toHaveTextContent(/Do not include confidential information\./);
+      expect(screen.getByRole("combobox", { name: /category/i })).toHaveValue("");
       expect(
-        screen.getByRole("link", { name: /PyRIT security reporting process/i }),
-      ).toHaveAttribute(
-        "href",
-        "https://github.com/microsoft/PyRIT/security/policy",
-      );
+        screen.queryByTestId("feedback-bug-describe-input"),
+      ).not.toBeInTheDocument();
       expect(
-        screen.getByRole("link", { name: /microsoft privacy statement/i }),
-      ).toHaveAttribute(
-        "href",
-        "https://privacy.microsoft.com/en-us/privacystatement",
-      );
+        screen.queryByTestId("feedback-submit-button"),
+      ).not.toBeInTheDocument();
     });
 
     it("does not render when closed", () => {
@@ -75,13 +65,21 @@ describe("FeedbackDialog", () => {
       expect(screen.queryByText("Send feedback")).not.toBeInTheDocument();
     });
 
-    it("offers all five template-backed categories in the dropdown", () => {
+    it("offers security and all five template-backed categories in the dropdown", () => {
       renderDialog();
       const select = screen.getByTestId(
         "feedback-category-select",
       ) as HTMLSelectElement;
       const values = Array.from(select.options).map((o) => o.value);
-      expect(values).toEqual(["bug", "feature", "doc", "praise", "other"]);
+      expect(values).toEqual([
+        "",
+        "security",
+        "bug",
+        "feature",
+        "doc",
+        "praise",
+        "other",
+      ]);
     });
 
     it("calls onClose when Cancel is clicked without opening any tab", async () => {
@@ -95,8 +93,9 @@ describe("FeedbackDialog", () => {
   });
 
   describe("category-driven fields", () => {
-    it("defaults to the bug category and renders bug-specific fields", () => {
+    it("renders bug-specific fields and the public issue warning for bug reports", async () => {
       renderDialog();
+      await pickCategory("bug");
       expect(
         screen.getByTestId("feedback-bug-describe-input"),
       ).toBeInTheDocument();
@@ -106,6 +105,42 @@ describe("FeedbackDialog", () => {
       expect(
         screen.getByTestId("feedback-bug-versions-input"),
       ).toBeInTheDocument();
+      expect(screen.getByTestId("feedback-sensitive-warning")).toHaveTextContent(
+        /public GitHub issue/i,
+      );
+      expect(
+        screen.getByRole("link", { name: /microsoft privacy statement/i }),
+      ).toHaveAttribute(
+        "href",
+        "https://privacy.microsoft.com/en-us/privacystatement",
+      );
+    });
+
+    it("shows only the private reporting route for security vulnerabilities", async () => {
+      renderDialog();
+      await pickCategory("security");
+
+      expect(screen.getByTestId("feedback-security-guidance")).toHaveTextContent(
+        /must be reported privately/i,
+      );
+      expect(
+        screen.getByRole("link", { name: /PyRIT security reporting process/i }),
+      ).toHaveAttribute(
+        "href",
+        "https://github.com/microsoft/PyRIT/security/policy",
+      );
+      expect(
+        screen.getByRole("link", { name: /open private reporting process/i }),
+      ).toHaveAttribute(
+        "href",
+        "https://github.com/microsoft/PyRIT/security/policy",
+      );
+      expect(
+        screen.queryByTestId("feedback-submit-button"),
+      ).not.toBeInTheDocument();
+      expect(
+        screen.queryByTestId("feedback-contact-input"),
+      ).not.toBeInTheDocument();
     });
 
     it("swaps to feature-request fields when feature is selected", async () => {
@@ -154,7 +189,7 @@ describe("FeedbackDialog", () => {
 
     it("clears prior fields when switching categories", async () => {
       renderDialog();
-      const user = userEvent.setup();
+      const user = await pickCategory("bug");
       const describe = screen.getByTestId(
         "feedback-bug-describe-input",
       ) as HTMLTextAreaElement;
@@ -182,6 +217,7 @@ describe("FeedbackDialog", () => {
   describe("submit gate", () => {
     it("disables Continue on GitHub until the primary field reaches the minimum length", async () => {
       renderDialog();
+      await pickCategory("bug");
       const submit = screen.getByTestId("feedback-submit-button");
       expect(submit).toBeDisabled();
 
@@ -208,7 +244,7 @@ describe("FeedbackDialog", () => {
     it("submits a bug to the bug_report template with GUI + Bug: triage labels", async () => {
       const onClose = jest.fn();
       renderDialog({ onClose });
-      const user = userEvent.setup();
+      const user = await pickCategory("bug");
       const describe = screen.getByTestId("feedback-bug-describe-input");
       await user.click(describe);
       await user.paste("Chat window crashes on empty send");
@@ -299,7 +335,7 @@ describe("FeedbackDialog", () => {
 
     it("omits the contact section when the contact field is blank", async () => {
       renderDialog();
-      const user = userEvent.setup();
+      const user = await pickCategory("bug");
       const describe = screen.getByTestId("feedback-bug-describe-input");
       await user.click(describe);
       await user.paste("Some sufficiently long bug description here");
@@ -313,7 +349,7 @@ describe("FeedbackDialog", () => {
 
     it("includes the contact section when one is provided", async () => {
       renderDialog();
-      const user = userEvent.setup();
+      const user = await pickCategory("bug");
       const describe = screen.getByTestId("feedback-bug-describe-input");
       await user.click(describe);
       await user.paste("Some sufficiently long bug description here");
@@ -347,7 +383,7 @@ describe("FeedbackDialog", () => {
   describe("secret detection", () => {
     it("does not show the secret warning for plain prose", async () => {
       renderDialog();
-      const user = userEvent.setup();
+      const user = await pickCategory("bug");
       const describe = screen.getByTestId("feedback-bug-describe-input");
       await user.click(describe);
       await user.paste("Plain feedback with no secrets at all.");
@@ -358,7 +394,7 @@ describe("FeedbackDialog", () => {
 
     it("shows the secret warning when a token-like value appears in any field", async () => {
       renderDialog();
-      const user = userEvent.setup();
+      const user = await pickCategory("bug");
       const repro = screen.getByTestId("feedback-bug-repro-input");
       await user.click(repro);
       await user.paste(
@@ -371,7 +407,7 @@ describe("FeedbackDialog", () => {
 
     it("opens the confirm dialog instead of GitHub when submitting with a detected secret", async () => {
       renderDialog();
-      const user = userEvent.setup();
+      const user = await pickCategory("bug");
       const describe = screen.getByTestId("feedback-bug-describe-input");
       await user.click(describe);
       await user.paste(
@@ -388,7 +424,7 @@ describe("FeedbackDialog", () => {
     it("cancels submission when the user clicks 'Go back and fix'", async () => {
       const onClose = jest.fn();
       renderDialog({ onClose });
-      const user = userEvent.setup();
+      const user = await pickCategory("bug");
       const describe = screen.getByTestId("feedback-bug-describe-input");
       await user.click(describe);
       await user.paste(
@@ -404,7 +440,7 @@ describe("FeedbackDialog", () => {
     it("proceeds to GitHub when the user explicitly clicks 'Submit anyway'", async () => {
       const onClose = jest.fn();
       renderDialog({ onClose });
-      const user = userEvent.setup();
+      const user = await pickCategory("bug");
       const describe = screen.getByTestId("feedback-bug-describe-input");
       await user.click(describe);
       await user.paste(
@@ -420,7 +456,7 @@ describe("FeedbackDialog", () => {
 
   it("resets the form when the dialog is reopened", async () => {
     const { unmount } = renderDialog();
-    const user = userEvent.setup();
+    const user = await pickCategory("bug");
     const describe = screen.getByTestId(
       "feedback-bug-describe-input",
     ) as HTMLTextAreaElement;
@@ -431,9 +467,9 @@ describe("FeedbackDialog", () => {
     unmount();
     renderDialog();
 
-    const describeAfter = screen.getByTestId(
-      "feedback-bug-describe-input",
-    ) as HTMLTextAreaElement;
-    expect(describeAfter.value).toBe("");
+    expect(screen.getByRole("combobox", { name: /category/i })).toHaveValue("");
+    expect(
+      screen.queryByTestId("feedback-bug-describe-input"),
+    ).not.toBeInTheDocument();
   });
 });
diff --git a/frontend/src/components/Feedback/FeedbackDialog.tsx b/frontend/src/components/Feedback/FeedbackDialog.tsx
index 76ba075028..20221595f6 100644
--- a/frontend/src/components/Feedback/FeedbackDialog.tsx
+++ b/frontend/src/components/Feedback/FeedbackDialog.tsx
@@ -40,8 +40,14 @@ interface FeedbackDialogProps {
   context?: FeedbackContext
 }
 
+type FeedbackSelection = FeedbackCategory | 'security'
+
 // The order here is also the order in the dropdown.
-const CATEGORIES: { value: FeedbackCategory; helper: string }[] = [
+const CATEGORIES: { value: FeedbackSelection; helper: string }[] = [
+  {
+    value: 'security',
+    helper: 'Privately report a potential security vulnerability',
+  },
   { value: 'bug', helper: 'Something is broken or producing the wrong result' },
   { value: 'feature', helper: 'An idea or improvement you would like to see' },
   { value: 'doc', helper: 'Documentation is missing, confusing, or out of date' },
@@ -49,6 +55,8 @@ const CATEGORIES: { value: FeedbackCategory; helper: string }[] = [
   { value: 'other', helper: 'Anything else' },
 ]
 
+const SECURITY_POLICY_URL = 'https://github.com/microsoft/PyRIT/security/policy'
+
 // Keep the assembled body short enough that the URL-encoded GitHub issue URL
 // fits well within browser and intermediate-proxy limits (~8 KB URL is safe).
 const MAX_FIELD_LENGTH = 5_000
@@ -84,11 +92,6 @@ const useStyles = makeStyles({
     color: tokens.colorPaletteDarkOrangeForeground1,
     fontWeight: tokens.fontWeightSemibold,
   },
-  warningGroup: {
-    display: 'flex',
-    flexDirection: 'column',
-    rowGap: tokens.spacingVerticalXS,
-  },
   helper: {
     color: tokens.colorNeutralForeground3,
     fontSize: tokens.fontSizeBase200,
@@ -100,6 +103,10 @@ const useStyles = makeStyles({
   },
 })
 
+function isFeedbackCategory(category: FeedbackSelection | ''): category is FeedbackCategory {
+  return category !== '' && category !== 'security'
+}
+
 /** Returns true iff the user has filled in enough to build a useful issue. */
 function getPrimaryField(
   category: FeedbackCategory,
@@ -165,7 +172,7 @@ function buildInput(
 
 export default function FeedbackDialog({ open, onClose, context }: FeedbackDialogProps) {
   const styles = useStyles()
-  const [category, setCategory] = useState<FeedbackCategory>('bug')
+  const [category, setCategory] = useState<FeedbackSelection | ''>('')
   const [fields, setFields] = useState<DialogFields>({})
   const [optionalContact, setOptionalContact] = useState('')
   const [confirmOpen, setConfirmOpen] = useState(false)
@@ -173,7 +180,9 @@ export default function FeedbackDialog({ open, onClose, context }: FeedbackDialo
   const update = (name: keyof DialogFields, value: string) =>
     setFields((prev) => ({ ...prev, [name]: value }))
 
-  const primary = getPrimaryField(category, fields)
+  const primary = isFeedbackCategory(category)
+    ? getPrimaryField(category, fields)
+    : { name: 'body' as const, value: '' }
   const primaryTrimmed = primary.value.trim()
   const primaryTooShort =
     primaryTrimmed.length > 0 && primaryTrimmed.length < MIN_PRIMARY_LENGTH
@@ -222,6 +231,7 @@ export default function FeedbackDialog({ open, onClose, context }: FeedbackDialo
   }
 
   const fireSubmit = () => {
+    if (!isFeedbackCategory(category)) return
     const input = buildInput(category, fields, optionalContact || undefined, context)
     const url = buildGithubFeedbackUrl(input)
     window.open(url, '_blank', 'noopener,noreferrer')
@@ -251,99 +261,126 @@ export default function FeedbackDialog({ open, onClose, context }: FeedbackDialo
                   handleSubmit()
                 }}
               >
-                <div
-                  className={styles.warningGroup}
-                  data-testid="feedback-sensitive-warning"
-                >
-                  <Text className={styles.warning}>
-                    Reporting a security vulnerability? Use the private{' '}
-                    <Link
-                      href="https://github.com/microsoft/PyRIT/security/policy"
-                      target="_blank"
-                      rel="noopener noreferrer"
-                    >
-                      PyRIT security reporting process
-                    </Link>
-                    .
-                  </Text>
-                  <Text className={styles.warning}>
-                    Other feedback is filed as a public GitHub issue. Do not include
-                    confidential information.
-                  </Text>
-                </div>
-
                 <Field label="Category" required>
                   <Select
                     value={category}
                     onChange={(_, data) => {
-                      setCategory(data.value as FeedbackCategory)
+                      setCategory(data.value as FeedbackSelection)
                       // Keep contact field; clear the rest so old answers don't
                       // accidentally end up under a different template.
                       setFields({})
                     }}
                     data-testid="feedback-category-select"
                   >
+                    <option value="" disabled>
+                      Select feedback type
+                    </option>
                     {CATEGORIES.map((c) => (
                       <option key={c.value} value={c.value}>
-                        {getCategoryLabel(c.value)}
+                        {c.value === 'security'
+                          ? 'Security vulnerability'
+                          : getCategoryLabel(c.value)}
                       </option>
                     ))}
                   </Select>
                   <Text className={styles.categoryHelper}>{helperForCategory}</Text>
                 </Field>
 
-                <CategoryRenderer
-                  category={category}
-                  fields={fields}
-                  update={update}
-                  primaryTooShort={primaryTooShort}
-                />
+                {category === 'security' && (
+                  <Text className={styles.warning} data-testid="feedback-security-guidance">
+                    Security vulnerabilities must be reported privately. Do not enter
+                    vulnerability details in this form. Use the{' '}
+                    <Link
+                      href={SECURITY_POLICY_URL}
+                      target="_blank"
+                      rel="noopener noreferrer"
+                    >
+                      PyRIT security reporting process
+                    </Link>
+                    .
+                  </Text>
+                )}
+
+                {isFeedbackCategory(category) && (
+                  <>
+                    <Text
+                      className={styles.warning}
+                      data-testid="feedback-sensitive-warning"
+                    >
+                      This feedback is filed as a public GitHub issue. Do not include
+                      confidential information.
+                    </Text>
 
-                <Field label="Preferred contact (optional)">
-                  <Input
-                    value={optionalContact}
-                    onChange={(_, data) => setOptionalContact(data.value)}
-                    placeholder="GitHub handle, email, alias — if you would like a reply"
-                    data-testid="feedback-contact-input"
-                  />
-                </Field>
+                    <CategoryRenderer
+                      category={category}
+                      fields={fields}
+                      update={update}
+                      primaryTooShort={primaryTooShort}
+                    />
 
-                <SecretWarning
-                  matches={secretMatches}
-                  confirmOpen={confirmOpen}
-                  onConfirmOpenChange={setConfirmOpen}
-                  onConfirmSubmit={fireSubmit}
-                />
+                    <Field label="Preferred contact (optional)">
+                      <Input
+                        value={optionalContact}
+                        onChange={(_, data) => setOptionalContact(data.value)}
+                        placeholder="GitHub handle, email, alias — if you would like a reply"
+                        data-testid="feedback-contact-input"
+                      />
+                    </Field>
 
-                <Text className={styles.helper}>
-                  Continuing opens a new tab on github.com with this form pre-filled. You
-                  will need a GitHub account to file the issue. Data you submit is
-                  governed by the{' '}
-                  <Link
-                    href="https://privacy.microsoft.com/en-us/privacystatement"
-                    target="_blank"
-                    rel="noopener noreferrer"
-                  >
-                    Microsoft Privacy Statement
-                  </Link>
-                  .
-                </Text>
+                    <SecretWarning
+                      matches={secretMatches}
+                      confirmOpen={confirmOpen}
+                      onConfirmOpenChange={setConfirmOpen}
+                      onConfirmSubmit={fireSubmit}
+                    />
+
+                    <Text className={styles.helper}>
+                      Continuing opens a new tab on github.com with this form pre-filled.
+                      You will need a GitHub account to file the issue. Data you submit is
+                      governed by the{' '}
+                      <Link
+                        href="https://privacy.microsoft.com/en-us/privacystatement"
+                        target="_blank"
+                        rel="noopener noreferrer"
+                      >
+                        Microsoft Privacy Statement
+                      </Link>
+                      .
+                    </Text>
+                  </>
+                )}
               </form>
             </DialogContent>
             <DialogActions>
               <Button appearance="secondary" onClick={onClose}>
                 Cancel
               </Button>
-              <Button
-                appearance="primary"
-                onClick={handleSubmit}
-                disabled={!canSubmit}
-                icon={<OpenRegular />}
-                iconPosition="after"
-                data-testid="feedback-submit-button"
-              >
-                Continue on GitHub
-              </Button>
+              {category === 'security' && (
+                <Button
+                  as="a"
+                  appearance="primary"
+                  href={SECURITY_POLICY_URL}
+                  target="_blank"
+                  rel="noopener noreferrer"
+                  icon={<OpenRegular />}
+                  iconPosition="after"
+                  onClick={onClose}
+                >
+                  Open private reporting process
+                </Button>
+              )}
+              {isFeedbackCategory(category) && (
+                <Button
+                  appearance="primary"
+                  onClick={handleSubmit}
+                  disabled={!canSubmit}
+                  icon={<OpenRegular />}
+                  iconPosition="after"
+                  data-testid="feedback-submit-button"
+                >
+                  Continue on GitHub
+                </Button>
+              )}
             </DialogActions>
           </DialogBody>
         </DialogSurface>

From 06ebffe82ddefb9ea15a4be3973a0da286103b77 Mon Sep 17 00:00:00 2001
From: Richard Lundeen <rlundeen@microsoft.com>
Date: Tue, 1 Sep 2026 14:17:22 -0700
Subject: [PATCH 4/4] TEST: Stabilize initializer dialog interaction

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 213b9228-bbd2-4dc8-a9b5-93cc6504e69c
---
 frontend/src/components/Configuration/Configuration.test.tsx | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/frontend/src/components/Configuration/Configuration.test.tsx b/frontend/src/components/Configuration/Configuration.test.tsx
index 6b3bff2754..e4f52abbb7 100644
--- a/frontend/src/components/Configuration/Configuration.test.tsx
+++ b/frontend/src/components/Configuration/Configuration.test.tsx
@@ -188,7 +188,7 @@ describe('Configuration', () => {
       'C:/Users/test/.pyrit/custom_initializers/custom_target.py',
       { selector: 'label' },
     )).toBeInTheDocument()
-    await user.click(screen.getByRole('button', { name: 'Add initializer' }))
+    fireEvent.click(screen.getByRole('button', { name: 'Add initializer' }))
     const dialog = screen.getByRole('dialog', { name: 'Add custom initializer' })
     await user.type(within(dialog).getByRole('textbox', { name: /Initializer name/ }), 'new_custom')
     fireEvent.change(within(dialog).getByRole('textbox', { name: 'Python source' }), {