This is an automated email from the ASF dual-hosted git repository.
rombert pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/sling-org-apache-sling-xss.git
The following commit(s) were added to refs/heads/master by this push:
new c5f91d2 Add security section to AGENTS.md
c5f91d2 is described below
commit c5f91d2b423385803621645b4150074261fb5338
Author: Robert Munteanu <[email protected]>
AuthorDate: Tue Jun 2 12:47:58 2026 +0200
Add security section to AGENTS.md
---
AGENTS.md | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/AGENTS.md b/AGENTS.md
index a1b6cfb..618d399 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -102,3 +102,10 @@ pom.xml
- `ESAPI.properties` and `validation.properties` lack Apache license headers
by design; they are RAT-excluded in `pom.xml`.
- `AntiSamyPolicyAdapter` intentionally uses `sun.misc.Unsafe` plus a Java 22+
fallback path to clear html-sanitizer attribute guards across JDK versions;
avoid refactoring this blindly.
- OSGi baseline comparison runs against the last released artifact. A
binary-incompatible change without a version bump will fail `mvn verify
-Pbaseline`.
+
+# Security
+
+<!-- sling-security-default:start -->
+The threat model for this project is
https://github.com/apache/sling/blob/master/docs/threat-model.md .
+<!-- sling-security-default:end -->
+
