samueleresca commented on code in PR #3478: URL: https://github.com/apache/pekko/pull/3478#discussion_r3882678006
########## THREAT_MODEL.md: ########## @@ -0,0 +1,420 @@ +# Apache Pekko — Threat Model + +**Status:** Reviewed by the Apache Pekko PMC, 2026-08-27. The thirteen questions this document was drafted around are answered in §14 and carry *(maintainer)* provenance; the residual module in/out split noted in §2 and Q6 is the one open item. + +| | | +| --- | --- | +| **Project** | Apache Pekko (core toolkit) | +| **Written against** | commit `90b02d60`, `main` | +| **Date** | 2026-08-27 | +| **Authors** | ASF Security team, at the request of the Pekko PMC | +| **Version binding** | This model is versioned alongside the project. A report against Pekko version *N* is triaged against the model as it stood at *N*, not at `main`. | +| **Reporting** | Findings that violate a §8 property should be reported per [`SECURITY.md`](SECURITY.md). Findings that fall under §3 or §9 will be closed citing this document. | + +**Provenance legend.** Every non-trivial claim is tagged: +*(documented)* — stated in Pekko's own docs, cited. Review Comment: We need to double-check that the claims based on documentation are correct (e.g., docs are up to date). I will take a deeper look over the weekend. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
