Add draft threat model + SECURITY.md + AGENTS.md for security-model discoverability

[potiuk]

This is a draft proposal for the JSPWiki PMC to review — please correct, reject, or discuss as needed. Nothing here is a requirement; the maintainers are the decision-makers, and this document describes JSPWiki as the PMC says it is, not as anyone thinks it should be.

This PR adds three files:

• THREAT_MODEL.md — a v0 threat model: what JSPWiki treats as in/out of scope, the trust boundaries and adversary model, the security properties it claims and disclaims (stored-XSS sanitization, ACL enforcement, attachment containment, …), the well-known wiki-engine attack classes left to the operator, and a closed set of triage dispositions.
• SECURITY.md — a security policy pointing at the ASF reporting process and linking the threat model.
• AGENTS.md — so an automated scan agent can mechanically find the model via the conventional AGENTS.md → SECURITY.md → THREAT_MODEL.md chain.

It is draft-first and mostly inferred. Confidence is roughly 14 documented / 0 maintainer / 58 inferred — every *(inferred)* claim is the agent's hypothesis from the code structure and wiki-engine domain norms, and each routes to a numbered question in §14 Open questions. The fastest way to review is to walk §14 (three short waves) and answer in-thread; we then promote the *(inferred)* tags to *(maintainer)* and the model firms up.

The highest-leverage answers are the wave-1 ones (default anonymous-edit posture, default markup engine + raw-HTML handling, whether the asserted cookie is ever used for a security decision) — they reshape several later sections.

Context: the ASF Security team is preparing the project for an automated agentic security scan we're piloting; a complete, discoverable threat model is what keeps that scan's output signal-rich instead of noise. We drafted this via the threat-model-producer rubric. If you'd rather author the model yourselves, close this PR and we'll regroup — the offer is just to save you the blank page.

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Adds security-related repository documentation to guide vulnerability reporting and to define an explicit threat model for triage/scoping.

Changes:

• Introduces a comprehensive threat model document for Apache JSPWiki.
• Adds a SECURITY.md security policy with reporting instructions and a link to the threat model.
• Adds an AGENTS.md guide to point automated tools/agents to the project’s security references.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
THREAT_MODEL.md	New threat model document defining scope, properties, and triage dispositions.
SECURITY.md	New security policy with private reporting guidance and threat model reference.
AGENTS.md	New agent-facing guide pointing scanners/AI to SECURITY.md and the threat model.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.