This is an automated email from the ASF dual-hosted git repository.
FreeAndNil pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/logging-log4net.git
The following commit(s) were added to refs/heads/master by this push:
new b9303c07 record why fetching the threat model is in the trust boundary
b9303c07 is described below
commit b9303c0725f4597647ddcedf526ce733e7b2d4ad
Author: Jan Friedrich <[email protected]>
AuthorDate: Wed Sep 2 23:25:27 2026 +0200
record why fetching the threat model is in the trust boundary
One PMC, the same committers on both repositories, and no review gate on
either,
so tampering with the model is no easier than editing AGENTS.md. Written
down
where the next scan will read it, since this keeps getting flagged.
---
AGENTS.md | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/AGENTS.md b/AGENTS.md
index d6f9eec5..5c6e37cb 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -12,6 +12,11 @@ This is mandatory: skipping steps leads to duplicate reports
and wasted time for
Fetch and read the project's security model before evaluating any finding:
https://raw.githubusercontent.com/apache/logging-site/refs/heads/main/src/site/antora/modules/ROOT/pages/_threat-model-common.adoc
+Fetching this is inside the trust boundary, not a supply chain risk, and scans
that flag it are
+answered here rather than overlooked. One PMC governs both repositories and
the same committers
+write to both, and neither requires review for a push, so anyone able to
tamper with the model
+could edit this file instead.
+
Use this to answer:
- Is this component/behavior in scope at all?
- Does the project consider this a security boundary?
