[PR] Add security threat model (THREAT_MODEL.md + SECURI TY.md pointer + AGENTS.md) [santuario-xml-security-java ]

potiuk opened a new pull request, #613:
URL: https://github.com/apache/santuario-xml-security-java/pull/613

   ## What
   
   Adds a **threat model** for Apache XML Security for Java, drafted at the Santuario PMC's request (the GLASSWING / Mythos scan pre-flight needs a discoverable threat model), plus the discoverability chain:
   
   - **`THREAT_MODEL.md`** — the model, following Michael Scovetta's rubric ([public mirror](https://gist.github.com/potiuk/da14a826283038ddfe38cc9fe6310573)).
   - **`SECURITY.md`** — your existing policy, **preserved**, with a new Threat Model pointer appended.
   - **`AGENTS.md`** — routes a vulnerability-research agent through `AGENTS.md -> SECURITY.md -> THREAT_MODEL.md`.
   
   ## The model in brief
   
   The defining trust split: the application is trusted, but **the XML submitted for verification/decryption is fully attacker-controlled**. The model is built around that, with **secure validation** mode as the load-bearing knob, and it makes explicit the two things the library deliberately leaves to the caller — **key trust** and **signature-coverage (XML-Signature-Wrapping) checks** — so scanner/AI reports against those route to "by design / caller's responsibility" rather than churning.
   
   ## DRAFT — you own and merge it
   
   Most claims are grounded in the source / your `SECURITY.md` (tagged *(documented)*); the trust assumptions I marked *(inferred)* are gathered as **open questions in section 14**. The pivotal one is **Q6 — secure-validation defaults**: for each entry point (native `org.apache.xml.security` vs JSR-105, DOM vs StAX, by version), is secure validation on by default or opt-in? That single answer decides whether "secure-validation-off" findings are valid or out-of-model. Please edit freely.
   
   ## Context
   
   This is the threat-model step of the GLASSWING pre-flight for `apache/santuario-xml-security-java`. Once it's merged and discoverable, pre-flight passes and we can queue the scan.
   
   Generated by the ASF Security team's threat-model tooling (Claude Opus); reviewed before opening.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]