This is an automated email from the ASF dual-hosted git repository.
jacopoc pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
The following commit(s) were added to refs/heads/trunk by this push:
new 93de9a21f5 Improved: Clarify security assumptions regarding default
configuration usage in OFBiz
93de9a21f5 is described below
commit 93de9a21f5cfbd36208a7aed06ea9b2869bc61a7
Author: Jacopo Cappellato <[email protected]>
AuthorDate: Wed Jul 8 11:51:28 2026 +0200
Improved: Clarify security assumptions regarding default configuration
usage in OFBiz
---
SECURITY.md | 1 +
1 file changed, 1 insertion(+)
diff --git a/SECURITY.md b/SECURITY.md
index a5e1bfd72d..7dffdfc206 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -28,6 +28,7 @@ Apache OFBiz assumes that:
* Administrative users are fully trusted.
* Customizations, plugins, and extensions are trusted code.
* External systems (databases, integrations, identity providers) are secured
independently.
+* The default configuration distributed with Apache OFBiz, including the
bundled database configuration, is provided to simplify evaluation,
development, and demonstration of the framework. It is not intended for
production use. Security reports based solely on assumptions that the default
demonstration configuration is used in a production environment may not
represent vulnerabilities in Apache OFBiz itself.
OFBiz does not attempt to defend against attackers who have obtained
administrative access to the application or high-privilege access to the host
system.
