This is an automated email from the ASF dual-hosted git repository.
meonkeys pushed a commit to branch develop
in repository https://gitbox.apache.org/repos/asf/fineract.git
The following commit(s) were added to refs/heads/develop by this push:
new ad9443eddf improve threat model
new 32b5487ca4 Merge pull request #6148 from meonkeys/improve-threat-model
ad9443eddf is described below
commit ad9443eddf85cb3263feea0290c95ef7b466f7b5
Author: Adam Monsen <[email protected]>
AuthorDate: Fri Jul 17 14:27:15 2026 -0700
improve threat model
* add "Proper reporting" section, primarly to discourage reporters from
using demo.mifos.org
* simplify intro at top
* remove "Signed releases" reference -- it adds nothing
* fix typo in §5a
---
SECURITY.md | 15 ++++++++++-----
1 file changed, 10 insertions(+), 5 deletions(-)
diff --git a/SECURITY.md b/SECURITY.md
index f67e7371d1..84138477bb 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -1,6 +1,6 @@
# Apache Fineract Threat Model
-This document is for human security researchers finding and [submitting
security reports](https://fineract.apache.org/#contribute), AI-assisted human
security researchers doing same, and Fineract PMC members handling these
reports.
+This document is for security researchers [privately
submitting](https://fineract.apache.org/#contribute) security reports and for
Fineract PMC members handling these reports.
## §1 Header
@@ -10,9 +10,7 @@ See [our top-level
readme](https://github.com/apache/fineract) for an introducti
## §2 Scope and intended use
-Source code repository: <https://github.com/apache/fineract>.
-
-Signed releases: <https://fineract.apache.org/#downloads>.
+Source code repository: <https://github.com/apache/fineract>
### Primary intended use cases
@@ -55,6 +53,13 @@ All scripts/configs used in build/dev/test, GitHub actions,
and the project webs
- **Physical access to the database server:** If an attacker has OS-level
access to the PostgreSQL/MariaDB host, the project assumes the game is already
lost.
- **Network-level DDoS:** The embedded Tomcat has configurable connection
limits, but volumetric DDoS mitigation is explicitly left to the reverse proxy
/ cloud provider.
+### Proper reporting
+
+* Security reports must be private.
+* Reports must refer to a release version or a commit on the `develop` (main
integration) branch.
+* Reports should include repro steps and example data (API calls or a loadable
database dump).
+* Repro steps must be performed directly on a running Fineract backend (API
server), not `demo.mifos.org` nor `sandbox.mifos.community` nor any other
third-party demo/deployment.
+
## §4 Trust boundaries and data flow
### Where the trust boundary sits
@@ -111,7 +116,7 @@ Multi-tenancy is implemented via schema-per-tenant or
database-per-tenant; tenan
## §5a Build-time and configuration variants
Fineract can be deployed in many ways.
-It configured at runtime via environment variables and Java properties.
+It may be configured at runtime via environment variables and Java properties.
See [Deployment](https://fineract.apache.org/docs/current/#_deployment) and
[Security](https://fineract.apache.org/docs/current/#_security) sections in the
official documentation for steps operators must follow as they work towards
deploying to production.
