oscerd opened a new pull request, #28081: URL: https://github.com/apache/camel/pull/28081
The OSS Helper's security commands read an optional fourth rule file, `project-security.md`. It holds the private reporting channel, the CNA, the advisory format and location, the supported release lines and the disclosure steps. When the Camel rules moved from the known-projects repository into `.oss-ai-helper-rules/` in June 2026, only the three required files came along. Project-local rules take precedence over installed ones, so the helper cannot see any of Camel's security settings, and the security commands ask the maintainer for them every time. This adds the file. It is based on the version that was in the known-projects repository, updated to today's state: - the supported maintenance branches are `camel-4.22.x` and `camel-4.18.x`; `camel-4.14.x` and older are end of life; - the undisclosed fix model: a neutral public Jira issue and PR, with no GitHub security advisories; - a pointer to `security-model.adoc` for triage; - how fixed versions are derived. Read the tags, not the pom version, because a patch release is cut before the version bump; and a tag is not a release until the artifacts are on Maven Central; - the ASF Security Team submits the CVE record once it references the published advisory. This is process documentation only: no code, build or generated-file change. `**/*.md` is already excluded from RAT, like the other three rule files. _Claude Code on behalf of oscerd_ 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
