(struts) branch main updated: docs: point CLAUDE.md at THREAT_MODEL.md for security scope (#1885)

[lu...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

lukaszlenart pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/struts.git


The following commit(s) were added to refs/heads/main by this push:
     new 16415adec docs: point CLAUDE.md at THREAT_MODEL.md for security scope (#1885)
16415adec is described below

commit 16415adec7b3ab8712a4dfda3236f9fb72fc9e55
Author: Lukasz Lenart <lu...@apache.org>
AuthorDate: Sun Aug 30 17:20:57 2026 +0200

    docs: point CLAUDE.md at THREAT_MODEL.md for security scope (#1885)
    
    The "Security Reports & Scans" section named SECURITY.md and AGENTS.md but
    not THREAT_MODEL.md, so anything working from CLAUDE.md alone reached the
    reporting process without the scope that decides whether there is anything
    to report. THREAT_MODEL.md was only reachable transitively, via a link in
    SECURITY.md or AGENTS.md.
    
    Name it directly, and say what it is for: the recurring non-findings (§11a)
    and the triage dispositions (§13) are what separate a real finding from a
    documented non-issue.
    
    
    Claude-Session: https://claude.ai/code/session_01AtyHU8BzNmeZNncXRu7yjB
    
    Co-authored-by: Claude Opus 5 <no...@anthropic.com>
---
 CLAUDE.md | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/CLAUDE.md b/CLAUDE.md
index 98e8f5382..ab6e96503 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -71,6 +71,9 @@ For any security-related activity — vulnerability scans, security analysis, dr
 Read it first and follow its pre-reporting checks, assessment checklist, and reporting requirements. Reports must be sent privately to
 `security@struts.apache.org`; do not open a public GitHub issue, Jira issue, pull request, or mailing list thread for a suspected vulnerability before private
 triage. [`AGENTS.md`](AGENTS.md) is a shorter LLM-facing wrapper around the same process.
+[`THREAT_MODEL.md`](THREAT_MODEL.md) is where the scope lives — trust boundaries, the security properties the framework does and does not provide, the
+recurring non-findings (§11a), and the triage dispositions (§13). Read it before judging whether a finding is real: on Struts most candidate findings are
+closed as application responsibility or non-default configuration rather than as framework bugs.
 
 ## Testing