(opendal) branch main updated: chore: Wire AGENTS.md -> SECURITY.md -> threat model for agent discoverability (#7785)

[ti...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

tisonkun pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/opendal.git


The following commit(s) were added to refs/heads/main by this push:
     new fa64e1471 chore: Wire AGENTS.md -> SECURITY.md -> threat model for agent discoverability (#7785)
fa64e1471 is described below

commit fa64e1471981831088f7dfb59ae0ae6cb4938f36
Author: Jarek Potiuk <ja...@potiuk.com>
AuthorDate: Wed Jun 17 10:55:44 2026 -0400

    chore: Wire AGENTS.md -> SECURITY.md -> threat model for agent discoverability (#7785)
    
    The project's security threat model already lives in SECURITY-THREAT-MODEL.md.
    This adds a SECURITY.md (ASF reporting pointer + a Threat Model link to it) and
    a Security section in AGENTS.md, so an automated security-scan agent can
    mechanically follow the conventional AGENTS.md -> SECURITY.md -> model chain.
    
    Generated-by: Claude Opus 4.8 (1M context)
---
 AGENTS.md   |  9 +++++++++
 SECURITY.md | 30 ++++++++++++++++++++++++++++++
 2 files changed, 39 insertions(+)

diff --git a/AGENTS.md b/AGENTS.md
index fe4f0dd0f..c3b1d3984 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -136,3 +136,12 @@ When adding or changing a public optional layer:
 - Use `opendal_core::raw::oio::{ReadStream, Write, List, Delete}` for operation bodies.
 - Use `Operator` and `blocking::Operator` as the public API entry points.
 - Prefer existing helpers in `opendal-core` before adding service-local utilities.
+
+## Security
+
+Security model: [SECURITY.md](./SECURITY.md)
+
+Agents that scan this repository should consult `SECURITY.md` and the threat
+model it links (`SECURITY-THREAT-MODEL.md`) for the project's in-scope /
+out-of-scope declarations, adversary model, and known non-findings before
+reporting issues.
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 000000000..7ba6d9b43
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,30 @@
+<!--
+  Licensed to the Apache Software Foundation (ASF) under one or more
+  contributor license agreements.  See the NOTICE file distributed with
+  this work for additional information regarding copyright ownership.
+  The ASF licenses this file to You under the Apache License, Version 2.0
+  (the "License"); you may not use this file except in compliance with
+  the License.  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+-->
+# Security Policy
+
+## Reporting a Vulnerability
+
+Apache OpenDAL follows the [Apache Software Foundation security process](https://www.apache.org/security/).
+Please report suspected vulnerabilities privately to `security@apache.org`;
+do not open public GitHub issues or pull requests for security reports.
+
+## Threat Model
+
+What the project treats as in scope and out of scope, the security
+properties it provides and disclaims, the adversary model, and how
+findings are triaged are documented in
+[SECURITY-THREAT-MODEL.md](./SECURITY-THREAT-MODEL.md).