Add a draft threat model and wire it for discoverability - #3478

Open

potiuk wants to merge 23 commits into

apache:mainfrom

potiuk:asf-security/threat-model-2026-08-27

Commits on Aug 31, 2026

Add a draft threat model and wire it for discoverability

potiuk
authored and
pjfanning
committed
deb6514
docs: correct scope and citations in the draft threat model
pjfanning
committed
82bf425
Update SECURITY.md
pjfanning
committed
90305c6
docs: drop the app-bound socket scope ruling from the threat model
pjfanning
committed
e790376
docs: keep the original upstream-coordination wording in SECURITY.md
pjfanning
committed
604f59f
docs: record the maintainer security posture and answer Q1, Q3 and Q4
pjfanning
committed
f26ada1
docs: answer Q2 and record who owns gadget-chain defence
pjfanning
committed
e461546
docs: answer Q5 - the persistence store is trusted
pjfanning
committed
be3517c
docs: answer the osgi half of Q6 - in model, but a removal candidate
pjfanning
committed
a00d961
docs: scope the model to this repository and finish Q6
pjfanning
committed
c544582
docs: correct how findings in other Pekko repositories are routed
pjfanning
committed
61d8172
docs: answer Q8, and Q7's environment-variable claim
pjfanning
committed
8dc516d
docs: answer Q9 - no compromised-node detection anywhere
pjfanning
committed
7eee33e
docs: answer Q7, Q10 and Q11
pjfanning
committed
8d8e619
docs: answer Q12 - no node reads another node's clock, except LWW
pjfanning
committed
c73df1f
docs: answer Q13 - classic remoting is still supported
pjfanning
committed
b577f7d
docs: make SECURITY.md canonical for the reporting policy
pjfanning
committed
90d7eb4
docs: cite the paradox docs for the LWW clock requirement
pjfanning
committed
d8a0d3b
docs: complete the §10 operator contract
pjfanning
committed
945bb49
docs: narrow Q8 - CPU cost is not in itself a security concern
pjfanning
committed
8e98b3b
docs: promote the threat model out of draft status

potiuk
authored and
pjfanning
committed
3c50f8f
docs: correct the shutdown-hook count - there are two, not one

potiuk
authored and
pjfanning
committed
eed22da
docs: tighten threat model on association, node loss, DNS parsing and remote deployment
pjfanning
committed
83fc684

Navigation Menu

Uh oh!

Add a draft threat model and wire it for discoverability - #3478

Add a draft threat model and wire it for discoverability#3478
potiuk wants to merge 23 commits into
apache:mainfrom
potiuk:asf-security/threat-model-2026-08-27

Commits on Aug 31, 2026

Add a draft threat model and wire it for discoverability

docs: correct scope and citations in the draft threat model

Update SECURITY.md

docs: drop the app-bound socket scope ruling from the threat model

docs: keep the original upstream-coordination wording in SECURITY.md

docs: record the maintainer security posture and answer Q1, Q3 and Q4

docs: answer Q2 and record who owns gadget-chain defence

docs: answer Q5 - the persistence store is trusted

docs: answer the osgi half of Q6 - in model, but a removal candidate

docs: scope the model to this repository and finish Q6

docs: correct how findings in other Pekko repositories are routed

docs: answer Q8, and Q7's environment-variable claim

docs: answer Q9 - no compromised-node detection anywhere

docs: answer Q7, Q10 and Q11

docs: answer Q12 - no node reads another node's clock, except LWW

docs: answer Q13 - classic remoting is still supported

docs: make SECURITY.md canonical for the reporting policy

docs: cite the paradox docs for the LWW clock requirement

docs: complete the §10 operator contract

docs: narrow Q8 - CPU cost is not in itself a security concern

docs: promote the threat model out of draft status

docs: correct the shutdown-hook count - there are two, not one

docs: tighten threat model on association, node loss, DNS parsing and remote deployment