AGENTS.md

1# Threat Model
2 
3This project maintains a living threat model at [`docs/threat-model.md`](docs/threat-model.md).
4 
5The threat model describes:
6 
7- The implicit contract between Apache Dubbo and its downstream users
8- Trust boundaries, adversary model, and assumptions about the deployment environment
9- Security properties Dubbo provides (conditional on configuration)
10- Security properties Dubbo explicitly does *not* provide
11- Downstream responsibilities for integrators
12- Known misuse patterns and recurring false positives
13- Triage dispositions for classifying vulnerability reports
14 
15## For vulnerability reporters
16 
17Before reporting, consult the threat model to determine whether the finding:
18 
19- Violates a claimed security property (§8) — report to [security@dubbo.apache.org](mailto:security@dubbo.apache.org)
20- Falls under an out-of-scope or by-design disclaimer (§3, §9) — will be closed citing the threat model
21- Matches a known non-finding (§11a) — already documented as a false positive
22 
23## For automated security tools
24 
25The threat model includes a machine-readable companion structure (§15) and a triage disposition table (§13) that can be used to automate report classification.
26 
27Key triage dispositions:
28 
29| Disposition | When to apply |
30|-------------|--------------|
31| `VALID` | Violates §8 property via in-scope adversary |
32| `OUT-OF-MODEL: trusted-input` | Requires attacker control of trusted registry/config |
33| `OUT-OF-MODEL: adversary-not-in-scope` | Requires excluded attacker capability |
34| `BY-DESIGN: property-disclaimed` | Concerns property explicitly disclaimed in §9 |
35| `KNOWN-NON-FINDING` | Matches documented false positive in §11a |
36