This is an automated email from the ASF dual-hosted git repository.
rombert pushed a commit to branch master
in repository
https://gitbox.apache.org/repos/asf/sling-org-apache-sling-servlets-post.git
The following commit(s) were added to refs/heads/master by this push:
new 7abcfcc Add security section to AGENTS.md
7abcfcc is described below
commit 7abcfcc36166ceedb954f7071aa285c4a33accea
Author: Robert Munteanu <[email protected]>
AuthorDate: Tue Jun 2 12:47:58 2026 +0200
Add security section to AGENTS.md
---
AGENTS.md | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/AGENTS.md b/AGENTS.md
index 9ffa371..8e282a7 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -77,3 +77,10 @@ developer-tests/
- **`ModifyOperationIT` classpath details:** Failsafe excludes
`jackrabbit-api` and the default `jackrabbit-jcr-commons`, then adds a newer
`jackrabbit-jcr-commons` for Oak compatibility. Re-check this setup when
changing JCR/Oak dependencies.
- **File upload chunking:** The chunked upload protocol uses custom JCR node
types defined in `chunk.cnd`. Changes to chunk handling must account for the
`ChunkCleanUpTask` scheduled cleanup.
- **`:redirect` URI validation:** `SlingPostServlet` validates redirect URIs
against the request host to prevent open-redirect. Tests must provide a proper
`Host` header or mock the URI check.
+
+# Security
+
+<!-- sling-security-default:start -->
+The threat model for this project is
https://github.com/apache/sling/blob/master/docs/threat-model.md .
+<!-- sling-security-default:end -->
+
