This is an automated email from the ASF dual-hosted git repository.
garydgregory pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/commons-secure-xml.git
The following commit(s) were added to refs/heads/main by this push:
new c716c20 Restructure SECURITY.md into a full security policy (#67)
c716c20 is described below
commit c716c20ea70e5b6c624b145e2e2551952a02e739
Author: Piotr P. Karwasz <[email protected]>
AuthorDate: Tue Sep 1 13:19:46 2026 +0200
Restructure SECURITY.md into a full security policy (#67)
* Restructure SECURITY.md into a full security policy
Split the page into four sections: supported versions (the 1.x release
line), private reporting through the Apache Commons Security Page, the
library threat model reports are triaged against, and the supply-chain
trust assumptions of the repository workflows. The latter documents
that apache/commons-* repositories are fully trusted and that trusting
GitHub-owned actions/* and github/* actions is an accepted risk, so
reports about unpinned references into either are out of scope.
Assisted-By: Claude Fable 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01CLnTBsvmYtxzNTWVGNyz33
* Style tweak.
---------
Co-authored-by: Gary Gregory <[email protected]>
---
SECURITY.md | 32 ++++++++++++++++++++++++++++++--
1 file changed, 30 insertions(+), 2 deletions(-)
diff --git a/SECURITY.md b/SECURITY.md
index 0e12026..370dcf0 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -16,6 +16,34 @@
-->
# Apache Commons Secure XML Security Policy
-Read the [Apache Commons Security
Page](https://commons.apache.org/security.html).
+## Supported Versions
-Read the [Apache Commons Secure XML Threat
Model](https://github.com/apache/commons-secure-xml/blob/main/src/site/markdown/threat_model.md).
+Security fixes are applied to the **1.x** release line.
+
+## Reporting Findings
+
+Report security findings privately, following the process on the
+[Apache Commons Security Page](https://commons.apache.org/security.html).
+Please do not open a public issue or pull request for a security finding.
+
+## Library Threat Model
+
+Findings against the library are triaged against the
+[Apache Commons Secure XML Threat
Model](https://github.com/apache/commons-secure-xml/blob/main/src/site/markdown/threat_model.md).
+It defines what the securing guarantees, what is out of scope, and the
disposition a report receives.
+
+## Supply-Chain Risks
+
+The workflows in this repository rest on the following trust assumptions:
+
+- **`apache/commons-*` repositories are fully trusted.**
+ They are maintained by the same Apache Commons project
+ under the same governance and access controls as this repository.
+- **The risk of trusting `actions/*` and `github/*` is judged acceptable.**
+ These are owned by GitHub,
+ the organisation that already runs the workflows and holds our secrets,
+ so trusting its actions adds no party that could not compromise the
workflows anyway.
+
+A workflow reference into any of these, by branch or tag instead of a pinned
commit,
+stays inside the accepted boundary.
+Reports about such unpinned references are out of scope.
