This is an automated email from the ASF dual-hosted git repository.
rombert pushed a commit to branch master
in repository
https://gitbox.apache.org/repos/asf/sling-org-apache-sling-scripting-spi.git
The following commit(s) were added to refs/heads/master by this push:
new d5e6308 Add security section to AGENTS.md
d5e6308 is described below
commit d5e6308ab9c0891ccf4e4a14993221f7e3dd5105
Author: Robert Munteanu <[email protected]>
AuthorDate: Tue Jun 2 12:47:58 2026 +0200
Add security section to AGENTS.md
---
AGENTS.md | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/AGENTS.md b/AGENTS.md
index e4fe6a7..420d921 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -90,3 +90,10 @@ target/ Maven output (do not edit)
- **Dual servlet APIs**: `BundledRenderUnit.eval(...)` has two overloads —
Jakarta (preferred) and javax (deprecated). The Jakarta default method
delegates to the javax abstract method for backward compat. New consumers
should implement the javax abstract method; it is called by the Jakarta
default. Do not remove the javax overload.
- **No OSGi runtime in tests**: tests run in plain JVM; do not reference
`BundleContext` or OSGi framework APIs in test code without mocking.
- The `target/` directory contains a committed baseline JAR snapshot
(`target/baseline/`). This is intentional — managed by
bnd-baseline-maven-plugin, not by hand.
+
+# Security
+
+<!-- sling-security-default:start -->
+The threat model for this project is
https://github.com/apache/sling/blob/master/docs/threat-model.md .
+<!-- sling-security-default:end -->
+
