potiuk opened a new pull request, #427: URL: https://github.com/apache/jackrabbit-filevault/pull/427
**This is a proposal for the Jackrabbit PMC to review — please correct, reject, or discuss as needed.** Nothing here is a requirement; the maintainer is the decision-maker. Thanks for merging the threat-model draft, Angela. Two small follow-ups make it mechanically discoverable to automated security scanners (and to any agent that follows the conventional file layout): **1. Wire the discoverability chain.** This adds `AGENTS.md` (a `## Security` pointer) and `SECURITY.md`, so the conventional `AGENTS.md → SECURITY.md → THREAT_MODEL.md` chain resolves. An automated scanner mechanically follows that chain to locate the model; without it, the model file is present but the scanner can't find it — discoverability is the one hard gate before a scan can run. *(On jackrabbit-oak this appends a `## Security` pointer to the existing `AGENTS.md` rather than creating a new one.)* **2. Rename `draft-THREAT-MODEL.md` → `THREAT_MODEL.md` (optional proposal).** Two reasons: - **It's no longer a draft.** The PMC has reviewed and merged it, so the `draft-` prefix now reads as "not yet adopted" when it is, in fact, the project's adopted model — the name undersells it. - **`THREAT_MODEL.md` is the conventional, discoverable name.** It's what the `AGENTS.md → SECURITY.md → model` chain and the scanners look for by default, and it matches the layout used across the other Apache repos in this effort (e.g. `apache/solr`). The rename also normalizes the separator (`THREAT-MODEL` → `THREAT_MODEL`). If you'd rather keep the `draft-` name (or pick a different one), just say so — the rename is the optional part; the wiring is the substantive fix, and we'll point `SECURITY.md` at whatever filename you prefer. Context: the ASF Security team is preparing the project for an automated agentic security scan. This PR changes **no model content** — only the file name and the discoverability wiring around it. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
