[PR] Add a draft THREAT_MODEL.md + SECURITY.md and link it from AGENTS.md [opendal]

["potiuk (via GitHub)" <gi...@apache.org>]

potiuk opened a new pull request, #7664:
URL: https://github.com/apache/opendal/pull/7664

   **This is a v1 *draft* threat model for the OpenDAL PMC to review — please
   correct, reject, or discuss as needed.** The maintainer is the
   decision-maker; nothing here is a requirement.
   
   This lands a draft `THREAT_MODEL.md` for `apache/opendal` and wires the
   conventional `AGENTS.md → SECURITY.md → THREAT_MODEL.md` chain so an automated
   security scanner can mechanically locate the model.
   
   - `THREAT_MODEL.md` (new) — a v1 draft modelling OpenDAL's trust boundaries
     (caller→`Operator`, OpenDAL→backend network, config/credential ingestion,
     FFI), the per-backend credential/auth surface, and the properties OpenDAL
     does / does not provide.
   - `SECURITY.md` (new) — routes vulnerability reports to the ASF security
     process and points at the threat model.
   - `AGENTS.md` — adds a Security section linking `SECURITY.md`; your existing
     `AGENTS.md` is otherwise unchanged.
   
   **How it was produced.** Drafted from OpenDAL's public artifacts (README, the
   `core/services/` + `core/layers/` structure) following the threat-model rubric
   at https://gist.github.com/scovetta/2dc9a0695c7cbcc32e23799e00d2ced3. Every
   claim is tagged *(documented)* — from your docs/source — or *(inferred)* —
   our reasoning, **not yet confirmed**. The inferred claims are collected as
   **"§14 Open questions for the maintainers"**; a one-line confirm/correct per
   question is enough, and we fold answers in (inferred → maintainer).
   
   The 15 open questions cover what only the PMC can settle: whether a
   malicious/compromised backend is in the adversary model (and how hardened
   response/listing parsing is); TLS fallback posture; whether the
   logging/tracing layers can ever emit credentials; SSRF / endpoint-trust
   responsibility; presigned-URL semantics; the `unsafe`/FFI memory-safety
   posture; and what scanners report that you consider non-findings (§11a).
   
   Context: the ASF Security team is preparing OpenDAL for an automated agentic
   security scan being piloted by the team; a discoverable model is the one hard
   pre-flight gate. This is the first of the in-scope repos — `opendal-reqsign`,
   `opendal-go-services`, and `opendal-oli` follow as separate PRs.
   
   Questions / pushback welcome — happy to adjust file placement or wording to
   match the project's house style.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@opendal.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Add a draft THREAT_MODEL.md + SECURITY.md and link it from AGENTS.md [opendal]

["potiuk (via GitHub)" <gi...@apache.org>]

potiuk closed pull request #7664: Add a draft THREAT_MODEL.md + SECURITY.md and link it from AGENTS.md
URL: https://github.com/apache/opendal/pull/7664


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@opendal.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Add a draft THREAT_MODEL.md + SECURITY.md and link it from AGENTS.md [opendal]

["potiuk (via GitHub)" <gi...@apache.org>]

potiuk commented on PR #7664:
URL: https://github.com/apache/opendal/pull/7664#issuecomment-4595158207

   Closing as a duplicate of #7641, which is the active draft threat-model PR for this repo. Apologies for the noise.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@opendal.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org