(unomi-tracker) branch main updated: Add AGENTS.md + SECURITY.md security-model discoverability pointers (#24)

[sh...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

sergehuber pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/unomi-tracker.git


The following commit(s) were added to refs/heads/main by this push:
     new c20cb01  Add AGENTS.md + SECURITY.md security-model discoverability pointers (#24)
c20cb01 is described below

commit c20cb01964423ff011c9f6d301331e0f1dc30522
Author: Jarek Potiuk <ja...@potiuk.com>
AuthorDate: Sun Jun 21 02:46:02 2026 -0400

    Add AGENTS.md + SECURITY.md security-model discoverability pointers (#24)
    
    Merging — discoverability goal LGTM. We’ll follow up on main to align AGENTS.md / SECURITY.md with the existing ASF header style used in README.md. Longer term the PMC may standardize on SPDX/REUSE repo-wide to reduce per-file headers; until then we’ll keep one convention per repo.
---
 AGENTS.md   | 16 ++++++++++++++++
 SECURITY.md | 16 ++++++++++++++++
 2 files changed, 32 insertions(+)

diff --git a/AGENTS.md b/AGENTS.md
new file mode 100644
index 0000000..75755fd
--- /dev/null
+++ b/AGENTS.md
@@ -0,0 +1,16 @@
+<!-- SPDX-License-Identifier: Apache-2.0
+     https://www.apache.org/legal/release-policy.html -->
+
+# Agent Guide for unomi-tracker
+
+This file is read by automated agents (security scanners, code
+analyzers, AI assistants) operating on this repository.
+
+## Security
+
+Security model: [SECURITY.md](./SECURITY.md)
+
+Agents that scan this repository should consult `SECURITY.md` and the
+threat model it links before reporting issues.
+
+Apache Unomi tracker is the client-side JS tracker; the project-wide threat model lives in `apache/unomi`.
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..2d0b10b
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,16 @@
+<!-- SPDX-License-Identifier: Apache-2.0
+     https://www.apache.org/legal/release-policy.html -->
+
+# Security Policy
+
+## Reporting a Vulnerability
+
+`apache/unomi-tracker` follows the [Apache Software Foundation security process](https://www.apache.org/security/). Please report suspected
+vulnerabilities privately to `security@apache.org`; do not open public
+GitHub issues or pull requests for security reports.
+
+## Threat Model
+
+What the project treats as in scope and out of scope, the security
+properties it provides and disclaims, the adversary model, and how
+findings are triaged are documented in <https://github.com/apache/unomi/blob/master/THREAT_MODEL.md>.