chore: add hyperlink injection in welcome email hall of fame (#2326)

* chore: add hyperlink injection in welcome email hall of fame

* Update pages/security/responsible-disclosure.mdx

Co-authored-by: ellipsis-dev[bot] <65095814+ellipsis-dev[bot]@users.noreply.github.com>

---------

Co-authored-by: ellipsis-dev[bot] <65095814+ellipsis-dev[bot]@users.noreply.github.com>

Author: Steffen911

pages/security/responsible-disclosure.mdx

@@ -33,15 +33,17 @@ Please note that we **currently do not operate a formal bug bounty program** wit
 
 We appreciate the efforts of security researchers who help keep Langfuse secure. The following individuals have responsibly disclosed vulnerabilities that led to improvements:
 
-| Reported by                                                                                                                 | PR with fix                                                                                                                                               | Description                                                                             |
-| --------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------- |
-| [Ather Iqbal](https://linkedin.com/in/atheriqbalhacker)                                                                     | [#4434](https://github.com/langfuse/langfuse/pull/4434)                                                                                                   | Password complexity + block links in user name                                          |
-| [Milan Jain](https://linkedin.com/in/milan-jain-scriptkiddie-50a738213)                                                     | [#6703](https://github.com/langfuse/langfuse/pull/6703)                                                                                                   | Hyperlink injection in organization invite email                                        |
-| [pyozzi](https://www.linkedin.com/in/sang-yeong-pyo-0411a6207)                                                              | [#8821](https://github.com/langfuse/langfuse/pull/8821)                                                                                                   | SSRF vulnerability in webhooks                                                          |
-| [depthfirst](https://www.depthfirst.com)                                                                                    | [#9027](https://github.com/langfuse/langfuse/pull/9027), [#9028](https://github.com/langfuse/langfuse/pull/9028)                                          | Protect background migration endpoints                                                  |
-| [Carsten Csiky](https://github.com/csicar/)                                                                                 | [#10223](https://github.com/langfuse/langfuse/pull/10223)                                                                                                 | Do not expose resolved but blocked IPs in user facing error messages.                   |
-| [Team-DisclosureX Cybrgen](https://linkedin.com/company/cybrgen-limited/), [J Sonali](https://www.linkedin.com/in/j-sonali) | [#10136](https://github.com/langfuse/langfuse/pull/10136), [CVE-2025-64504](https://github.com/langfuse/langfuse/security/advisories/GHSA-94hf-6gqq-pj69) | Cross‑organization enumeration of member & invitation lists via project membership APIs |
-| [David Bors at Snyk Security Labs](https://www.linkedin.com/in/davidxbors/)                                                                                           | [#10426](https://github.com/langfuse/langfuse/pull/10426), [GHSA-w9pw-c549-5m6w](https://github.com/langfuse/langfuse/security/advisories/GHSA-w9pw-c549-5m6w)                                                                                                 | SSO Account Takeover via CSRF or phishing attack
+| Reported by                                                                                                                 | PR with fix                                                                                                                                                    | Description                                                                             |
+|-----------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------|
+| [Ather Iqbal](https://linkedin.com/in/atheriqbalhacker)                                                                     | [#4434](https://github.com/langfuse/langfuse/pull/4434)                                                                                                        | Password complexity + block links in user name                                          |
+| [Milan Jain](https://linkedin.com/in/milan-jain-scriptkiddie-50a738213)                                                     | [#6703](https://github.com/langfuse/langfuse/pull/6703)                                                                                                        | Hyperlink injection in organization invite email                                        |
+| [pyozzi](https://www.linkedin.com/in/sang-yeong-pyo-0411a6207)                                                              | [#8821](https://github.com/langfuse/langfuse/pull/8821)                                                                                                        | SSRF vulnerability in webhooks                                                          |
+| [depthfirst](https://www.depthfirst.com)                                                                                    | [#9027](https://github.com/langfuse/langfuse/pull/9027), [#9028](https://github.com/langfuse/langfuse/pull/9028)                                               | Protect background migration endpoints                                                  |
+| [Carsten Csiky](https://github.com/csicar/)                                                                                 | [#10223](https://github.com/langfuse/langfuse/pull/10223)                                                                                                      | Do not expose resolved but blocked IPs in user facing error messages.                   |
+| [Team-DisclosureX Cybrgen](https://linkedin.com/company/cybrgen-limited/), [J Sonali](https://www.linkedin.com/in/j-sonali) | [#10136](https://github.com/langfuse/langfuse/pull/10136), [CVE-2025-64504](https://github.com/langfuse/langfuse/security/advisories/GHSA-94hf-6gqq-pj69)      | Cross‑organization enumeration of member & invitation lists via project membership APIs |
+| [David Bors at Snyk Security Labs](https://www.linkedin.com/in/davidxbors/)                                                 | [#10426](https://github.com/langfuse/langfuse/pull/10426), [GHSA-w9pw-c549-5m6w](https://github.com/langfuse/langfuse/security/advisories/GHSA-w9pw-c549-5m6w) | SSO Account Takeover via CSRF or phishing attack                                        |
+| [Sankalp Tripathi](https://linkedin.com/in/sankalp-tripathi-9bbb982b9)                                                              | [#10603](https://github.com/langfuse/langfuse/pull/10603)                                                                                                      | Hyperlink injection in welcome email                                                    |
+
 ## Contact
 
 For all security-related inquiries, including vulnerability disclosures, please contact [email protected].