svn commit: r1934746 - pdfbox/trunk

[ms...@apache.org]

Author: msahyoun
Date: Fri May 29 10:57:36 2026
New Revision: 1934746

Log:
PDFBOX-6208: require agents to read SECURITY.md before analysis

Modified:
   pdfbox/trunk/AGENTS.md

Modified: pdfbox/trunk/AGENTS.md
==============================================================================
--- pdfbox/trunk/AGENTS.md	Fri May 29 10:09:25 2026	(r1934745)
+++ pdfbox/trunk/AGENTS.md	Fri May 29 10:57:36 2026	(r1934746)
@@ -21,6 +21,17 @@ This file is read by automated agents (s
 AI assistants) operating on this repository. It points them at the
 human-authored references they should consult before producing output.
 
+## Prerequisites — Must Read Before Proceeding
+
+Agents MUST read the following files before conducting any analysis,
+security assessment, or code review of this repository:
+
+1. **[SECURITY.md](SECURITY.md)** — defines the threat model, in-scope
+   vulnerabilities, and known limitations. Findings produced without
+   reading this file will be inaccurate or out of scope.
+2. **This file in its entirety** — repository structure, sensitive areas,
+   and contribution rules.
+
 ## Project Overview
 
 Apache PDFBox is a Java library for working with PDF documents. It is used
@@ -92,8 +103,7 @@ Avoid large refactorings in these areas
 Security model and scope: [SECURITY.md](SECURITY.md),
 also published at <https://pdfbox.apache.org/security.html>.
 
-Agents that scan this repository **must** read the security model before
-reporting any finding. In particular, note:
+Key points from the security model:
 
 - Processing malformed PDFs is **partially in scope**: crashes, unchecked
   exceptions (`NullPointerException`, `StackOverflowError`), or general
@@ -105,8 +115,7 @@ reporting any finding. In particular, no
 - Issues that require the attacker to control the Java application's classpath
   or configuration are **out of scope**.
 
-For a list of known CVEs, see [SECURITY.md](SECURITY.md) or
-<https://pdfbox.apache.org/security.html>.
+For a list of known CVEs, see <https://pdfbox.apache.org/security.html>.
 
 To report a new vulnerability, send a plain-text email to <se...@apache.org>.
 Do **not** open a public JIRA issue for undisclosed vulnerabilities.