potiuk opened a new pull request, #3509: URL: https://github.com/apache/kvrocks/pull/3509
**This is a draft proposal for the Kvrocks PMC to review — please correct, reject, or discuss as needed.** Nothing here is a requirement; the maintainers are the decision-makers, and this document describes Kvrocks *as the PMC says it is*. This PR adds **`THREAT_MODEL.md`** + **`SECURITY.md`** and a **Security** section in `AGENTS.md`, so an automated scan agent can mechanically find the model via `AGENTS.md → SECURITY.md → THREAT_MODEL.md`. It is **draft-first and mostly inferred** (~16 documented / 0 maintainer / ~50 inferred). Every `*(inferred)*` claim routes to a numbered question in **§14 Open questions** — the fastest review is to walk §14 (three short waves) and answer in-thread; we then promote the tags to `*(maintainer)*`. The **wave-1** rulings are load-bearing: - Is running **without `requirepass`** (the default) a supported posture relying on `bind`/network controls, or must operators set it before exposing the port — i.e. is an unauthenticated-access report `BY-DESIGN` or `VALID`? - Same for **TLS-off** on an untrusted network — operator responsibility or a claimed gap? - Are **replication / cluster peers** trusted (out of the adversary model) or should a malicious peer be in scope? `apache/kvrocks-controller` is in scope for the scan too; per §14 q10 it will get its **own** model (its trust surface — the cluster control plane — differs), which we'll open as a separate PR. Context: the ASF Security team is preparing the project for an automated agentic security scan we're piloting; a complete, discoverable threat model keeps that scan's output signal-rich. We drafted this via the [threat-model-producer](https://gist.github.com/potiuk/da14a826283038ddfe38cc9fe6310573) rubric. If you'd rather author it yourselves, close this PR and we'll regroup. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
