vinishjail97 opened a new pull request, #966: URL: https://github.com/apache/incubator-xtable/pull/966
## What is the purpose of the pull request The repository has no security policy, and no written statement of what the project treats as a vulnerability. The ASF security team asks projects to document a security model, so that reports can be triaged against intended use. Several Apache projects (brpc, JMeter, Nutch) follow the same pattern of a `SECURITY.md` that links to a `THREAT_MODEL.md`. ## Brief change log - Add `SECURITY.md`, which routes vulnerability reports to [email protected] under the ASF process and links to the threat model. - Add `THREAT_MODEL.md`, which states the trust boundaries, what is in scope, what is out of scope, the security properties XTable does not provide, operator responsibilities, known non-findings, triage labels, and the conditions that would require a revision. The threat model is written against the current `main`. It treats `xtable-service` as a developer utility, consistent with its README (#914), and lists the open proposals (#702, #945, #946, #891, #964) that would require it to be revised. The threat model is marked as a v1 draft and needs PPMC review before it is treated as policy. ## Verify this pull request Documentation only. No source changes. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
