From e5cf90d9c60102fda6ad627d9fea049e443229e9 Mon Sep 17 00:00:00 2001 From: Lukasz Lenart Date: Sun, 30 Aug 2026 17:14:00 +0200 Subject: [PATCH] docs: point CLAUDE.md at THREAT_MODEL.md for security scope MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The "Security Reports & Scans" section named SECURITY.md and AGENTS.md but not THREAT_MODEL.md, so anything working from CLAUDE.md alone reached the reporting process without the scope that decides whether there is anything to report. THREAT_MODEL.md was only reachable transitively, via a link in SECURITY.md or AGENTS.md. Name it directly, and say what it is for: the recurring non-findings (§11a) and the triage dispositions (§13) are what separate a real finding from a documented non-issue. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01AtyHU8BzNmeZNncXRu7yjB --- CLAUDE.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/CLAUDE.md b/CLAUDE.md index 98e8f53826..ab6e965033 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -71,6 +71,9 @@ For any security-related activity — vulnerability scans, security analysis, dr Read it first and follow its pre-reporting checks, assessment checklist, and reporting requirements. Reports must be sent privately to `security@struts.apache.org`; do not open a public GitHub issue, Jira issue, pull request, or mailing list thread for a suspected vulnerability before private triage. [`AGENTS.md`](AGENTS.md) is a shorter LLM-facing wrapper around the same process. +[`THREAT_MODEL.md`](THREAT_MODEL.md) is where the scope lives — trust boundaries, the security properties the framework does and does not provide, the +recurring non-findings (§11a), and the triage dispositions (§13). Read it before judging whether a finding is real: on Struts most candidate findings are +closed as application responsibility or non-default configuration rather than as framework bugs. ## Testing