mirror of
https://github.com/apache/cloudstack
synced 2026-08-02 05:26:35 +00:00
d2a3bd1aa7
The project-wide security threat model merged (apache/cloudstack#13293) as draft-THREAT-MODEL.md, but the canonical discoverability name that scanners and satellite-repo SECURITY.md pointers follow is THREAT_MODEL.md. This renames the file to THREAT_MODEL.md and updates the in-repo SECURITY.md reference, making the pointer in apache/cloudstack-cloudmonkey (which already targets .../blob/main/THREAT_MODEL.md) resolve. The document's own review-status wording is unchanged. Generated-by: Claude Opus 4.8 (1M context)
35 lines
1.4 KiB
Markdown
35 lines
1.4 KiB
Markdown
<!--
|
|
Licensed to the Apache Software Foundation (ASF) under one
|
|
or more contributor license agreements. See the NOTICE file
|
|
distributed with this work for additional information
|
|
regarding copyright ownership. The ASF licenses this file
|
|
to you under the Apache License, Version 2.0 (the
|
|
"License"); you may not use this file except in compliance
|
|
with the License. You may obtain a copy of the License at
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing,
|
|
software distributed under the License is distributed on an
|
|
"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
|
|
KIND, either express or implied. See the License for the
|
|
specific language governing permissions and limitations
|
|
under the License.
|
|
-->
|
|
|
|
# Security Policy
|
|
|
|
## Reporting a Vulnerability
|
|
|
|
`apache/cloudstack` follows the [Apache Software Foundation security process](https://www.apache.org/security/). Please report suspected
|
|
vulnerabilities privately to `security@apache.org`; do not open public GitHub issues or pull requests for security reports.
|
|
|
|
For more details, see https://cloudstack.apache.org/security.html.
|
|
|
|
## Threat Model
|
|
|
|
What the project treats as in scope and out of scope, the security
|
|
properties it provides and disclaims, the adversary model, and how
|
|
findings are triaged are documented in the project-wide threat model:
|
|
[THREAT_MODEL.md](THREAT_MODEL.md).
|
