Skip to content

Add draft threat model + SECURITY.md/AGENTS.md discoverability #6709

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
vlsi merged 1 commit into from
Jun 5, 2026
+233 −0
Merged

Add draft threat model + SECURITY.md/AGENTS.md discoverability #6709

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions .ratignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,13 +3,16 @@ gradle/verification-keyring.keys
gradle/verification-metadata.xml
**/.*
.*/**
AGENTS.md
CODE_OF_CONDUCT.md
CONTRIBUTING.md
eclipse.md
gradle.md
ISSUE_TEMPLATE.md
PULL_REQUEST_TEMPLATE.md
README.md
SECURITY.md
THREAT_MODEL.md
renovate.json
**/*.jmx
bin/examples/**
Expand Down
1 change: 1 addition & 0 deletions AGENTS.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Security model: [SECURITY.md](./SECURITY.md)
Copy link
Copy Markdown
Collaborator

@vlsi vlsi Jun 6, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The more I think about it the more I am leaning towards removing the line from agents.md. Security.md is a well-known file, and any agent should look for security.md with no extra guides given.
@potiuk , do you know where does the recommendation to link security from agents come from?

Copy link
Copy Markdown
Member Author

@potiuk potiuk Jun 6, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

From the official AGENTS.md "specification" https://agents.md/

  1. Cover what matters
    Add sections that help an agent work effectively with your project. Popular choices:

Project overview
Build and test commands
Code style guidelines
Testing instructions
Security considerations

Copy link
Copy Markdown
Member Author

@potiuk potiuk Jun 6, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

And to be honest, it is 0 cost of maintenance yet, adds eome additional disoverability hint, so removal gains you nothing :).

13 changes: 13 additions & 0 deletions SECURITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,13 @@
# Security Policy

## Reporting a Vulnerability

`apache/jmeter` follows the [Apache Software Foundation security process](https://www.apache.org/security/). Please report suspected
vulnerabilities privately to `security@apache.org`; do not open public
GitHub issues or pull requests for security reports.

## Threat Model

What the project treats as in scope and out of scope, the security
properties it provides and disclaims, the adversary model, and how
findings are triaged are documented in [THREAT_MODEL.md](./THREAT_MODEL.md).
Loading
Loading