Repository navigation
docs(security): answer the threat model's open questions - #2010
Merged
Merged
Conversation
A PMC member answered Q1-Q11, each checked against the code first. Where the proposed answer described something the code does not do, the claim is narrowed to what ships instead of being ratified as written. - Adopt strict triage and a closed symptom vocabulary. - Keep the unreviewed-change adversary in the model, since required review on main is lifted, and narrow C-D6 to match. - Scope C-K3 and C-I3 to the components that meet them. - Record patch pinning as a design requirement, not a property. - Add claims for the backtest gaps, including egress scoping now that apache#1978 has landed. - Bring scope and trust boundaries up to date with the shipped tools. Point the project config at the private tracker and the security model, and correct two mailing-list addresses that do not exist. Generated-by: Claude Opus 5
github-actions
Bot
added
family:security
potiuk
enabled auto-merge (squash)
November 5, 2026 12:56
6 tasks done
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The threat model has been a draft since #1859, with 11 open questions waiting on maintainers.
This answers them, with each proposed answer checked against the code first.
Several proposals described things the code does not do, so those claims are narrowed to what ships rather than ratified as written.
strict, and a closed symptom vocabulary. The rubric's terms are memory-safety ones, so three framework-specific terms are declared alongside them.mainstay in the model. The proposal relied on branch protection, but.asf.yamlhas required review lifted, so P8 stays in and C-D6 is narrowed. Restoring required review closes this (Q12).Config:
tracker_reponow points atapache/magpie-security,security-model.mdis added (the model skills require it), andprojects/magpie/project.mdno longer names two lists that do not exist.Reports still go to
security@apache.org.Regression check: every fixed item in the backtest was re-routed against the amended model, and none routes to a closing disposition.
Narrowing sends a report against an unnamed component to
MODEL-GAP, which escalates.Type of change
docs/,README.md,CONTRIBUTING.md)Test plan
prek run --all-files --skip workspace-pytestpassesGen-AI disclosure
Drafted with Claude Code and reviewed by the maintainer, who answered each question.
🤖 Generated with Claude Code