This is an automated email from the ASF dual-hosted git repository.
lukaszlenart pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/struts.git
The following commit(s) were added to refs/heads/main by this push:
new 16415adec docs: point CLAUDE.md at THREAT_MODEL.md for security scope
(#1885)
16415adec is described below
commit 16415adec7b3ab8712a4dfda3236f9fb72fc9e55
Author: Lukasz Lenart <[email protected]>
AuthorDate: Sun Aug 30 17:20:57 2026 +0200
docs: point CLAUDE.md at THREAT_MODEL.md for security scope (#1885)
The "Security Reports & Scans" section named SECURITY.md and AGENTS.md but
not THREAT_MODEL.md, so anything working from CLAUDE.md alone reached the
reporting process without the scope that decides whether there is anything
to report. THREAT_MODEL.md was only reachable transitively, via a link in
SECURITY.md or AGENTS.md.
Name it directly, and say what it is for: the recurring non-findings (§11a)
and the triage dispositions (§13) are what separate a real finding from a
documented non-issue.
Claude-Session: https://claude.ai/code/session_01AtyHU8BzNmeZNncXRu7yjB
Co-authored-by: Claude Opus 5 <[email protected]>
---
CLAUDE.md | 3 +++
1 file changed, 3 insertions(+)
diff --git a/CLAUDE.md b/CLAUDE.md
index 98e8f5382..ab6e96503 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -71,6 +71,9 @@ For any security-related activity — vulnerability scans,
security analysis, dr
Read it first and follow its pre-reporting checks, assessment checklist, and
reporting requirements. Reports must be sent privately to
`[email protected]`; do not open a public GitHub issue, Jira issue,
pull request, or mailing list thread for a suspected vulnerability before
private
triage. [`AGENTS.md`](AGENTS.md) is a shorter LLM-facing wrapper around the
same process.
+[`THREAT_MODEL.md`](THREAT_MODEL.md) is where the scope lives — trust
boundaries, the security properties the framework does and does not provide, the
+recurring non-findings (§11a), and the triage dispositions (§13). Read it
before judging whether a finding is real: on Struts most candidate findings are
+closed as application responsibility or non-default configuration rather than
as framework bugs.
## Testing
