[PR] chore: add project-security.md to the OSS helper rules [camel]

["oscerd (via GitHub)" <gi...@apache.org>]

oscerd opened a new pull request, #28081:
URL: https://github.com/apache/camel/pull/28081

   The OSS Helper's security commands read an optional fourth rule file, `project-security.md`. It holds the private reporting channel, the CNA, the advisory format and location, the supported release lines and the disclosure steps. When the Camel rules moved from the known-projects repository into `.oss-ai-helper-rules/` in June 2026, only the three required files came along. Project-local rules take precedence over installed ones, so the helper cannot see any of Camel's security settings, and the security commands ask the maintainer for them every time.
   
   This adds the file. It is based on the version that was in the known-projects repository, updated to today's state:
   
   - the supported maintenance branches are `camel-4.22.x` and `camel-4.18.x`; `camel-4.14.x` and older are end of life;
   - the undisclosed fix model: a neutral public Jira issue and PR, with no GitHub security advisories;
   - a pointer to `security-model.adoc` for triage;
   - how fixed versions are derived. Read the tags, not the pom version, because a patch release is cut before the version bump; and a tag is not a release until the artifacts are on Maven Central;
   - the ASF Security Team submits the CVE record once it references the published advisory.
   
   This is process documentation only: no code, build or generated-file change. `**/*.md` is already excluded from RAT, like the other three rule files.
   
   _Claude Code on behalf of oscerd_
   
   🤖 Generated with [Claude Code](https://claude.com/claude-code)
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] chore: add project-security.md to the OSS helper rules [camel]

["github-actions[bot] (via GitHub)" <gi...@apache.org>]

github-actions[bot] commented on PR #28081:
URL: https://github.com/apache/camel/pull/28081#issuecomment-6262566453

   :star2: Thank you for your contribution to the Apache Camel project! :star2:
     :robot: CI automation will test this PR automatically.
   
     :camel: Apache Camel Committers, please review the following items:
   
     * First-time contributors **require MANUAL approval** for the GitHub Actions to run
     * You can use the command `/component-test (camel-)component-name1 (camel-)component-name2..` to request a test from the test bot although they are normally detected and executed by CI.
     * You can label PRs using `skip-tests` and `test-dependents` to fine-tune the checks executed by this PR.
     * Build and test logs are available in the summary page. **Only** [Apache Camel committers](https://camel.apache.org/community/team/#committers) have access to the summary.
     
     :warning: Be careful when sharing logs. Review their contents before sharing them publicly.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] chore: add project-security.md to the OSS helper rules [camel]

["oscerd (via GitHub)" <gi...@apache.org>]

oscerd merged PR #28081:
URL: https://github.com/apache/camel/pull/28081


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org