{"owner":"apache","repo":"dubbo","hasSkills":true,"hasMcp":false,"mcpConfig":null,"found":["AGENTS.md"],"files":{"AGENTS.md":"# Threat Model\n\nThis project maintains a living threat model at [`docs/threat-model.md`](docs/threat-model.md).\n\nThe threat model describes:\n\n- The implicit contract between Apache Dubbo and its downstream users\n- Trust boundaries, adversary model, and assumptions about the deployment environment\n- Security properties Dubbo provides (conditional on configuration)\n- Security properties Dubbo explicitly does *not* provide\n- Downstream responsibilities for integrators\n- Known misuse patterns and recurring false positives\n- Triage dispositions for classifying vulnerability reports\n\n## For vulnerability reporters\n\nBefore reporting, consult the threat model to determine whether the finding:\n\n- Violates a claimed security property (§8) — report to [security@dubbo.apache.org](mailto:security@dubbo.apache.org)\n- Falls under an out-of-scope or by-design disclaimer (§3, §9) — will be closed citing the threat model\n- Matches a known non-finding (§11a) — already documented as a false positive\n\n## For automated security tools\n\nThe threat model includes a machine-readable companion structure (§15) and a triage disposition table (§13) that can be used to automate report classification.\n\nKey triage dispositions:\n\n| Disposition | When to apply |\n|-------------|--------------|\n| `VALID` | Violates §8 property via in-scope adversary |\n| `OUT-OF-MODEL: trusted-input` | Requires attacker control of trusted registry/config |\n| `OUT-OF-MODEL: adversary-not-in-scope` | Requires excluded attacker capability |\n| `BY-DESIGN: property-disclaimed` | Concerns property explicitly disclaimed in §9 |\n| `KNOWN-NON-FINDING` | Matches documented false positive in §11a |\n"}}