potiuk opened a new pull request, #3038: URL: https://github.com/apache/tika/pull/3038
**This is a proposal for the PMC to review — please correct, reject, or discuss as needed.** Nothing here is a requirement; the maintainer is the decision-maker. This adds a `## Security` section to `AGENTS.md` so an automated scan agent can mechanically discover Tika's security model via the conventional `AGENTS.md → SECURITY.md → model` chain. ### Why Tim asked ASF Tooling for a Claude security scan of Tika on 2026-08-18, and Dave Fisher confirmed Tika can go into the next batch. The scan agent locates a project's security model by following `AGENTS.md → SECURITY.md`. Tika's `SECURITY.md` already does its half correctly — it links https://tika.apache.org/security-model.html and frames it exactly right ("review Tika's security model to understand what is and isn't considered a vulnerability"). But `AGENTS.md` currently points only at `.skills/`, so the chain breaks at the first hop and the agent never reaches the model. This is the one mechanical gap. Everything else about the model is a separate conversation happening on the PMC's private list. ### What this does not change Nothing about the model's content. The section links the file you already have; the wording of the published security model is untouched. ### Note on the model itself For what it's worth, Tika's security model is a stronger starting point than most — it draws a real boundary between untrusted data and untrusted callers, and it has demonstrably done its job: several recent reports were correctly routed by that page, two of which the reporter withdrew after reading it. Questions and pushback welcome — happy to adjust the wording or move the section if the project has a house style. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
