Add draft project security threat-model document by potiuk · Pull Request #13293 · apache/cloudstack

potiuk · 2026-05-30T00:13:57Z

Summary

This PR adds an initial draft of a project-level security
threat-model document (draft-THREAT-MODEL.md) so that automated
security scanners running against this repository have a
maintainer-facing reference for which classes of findings are
in-scope vs. out-of-scope for the project.

The document follows the rubric format used by several other ASF
projects piloting improved security-model discoverability for
agentic scanners. Every claim carries a provenance tag:

(documented) — paraphrased from public artefacts (this repo or
the project website), cited inline.
(inferred) — synthesised from code structure or domain
knowledge; the PMC has not confirmed.
(maintainer) — confirmed by a CloudStack PMC member in response
to this draft. (Zero in this initial draft.)

Draft stats:

~88 documented claims
~64 inferred claims (each maps to a §14 question)
38 open questions for maintainers in §14

§14 is the highest-leverage section: answering each question
either promotes one (inferred) tag to (maintainer) or corrects
the underlying claim.

Why "draft-" prefix?

The file is named draft-THREAT-MODEL.md rather than
SECURITY-THREAT-MODEL.md because this is a proposal for the
PMC to review — please correct, reject, or discuss as needed.
Once the PMC ratifies (or substantially edits) the content, the
file can be renamed in a follow-up PR and a discoverability
scaffold (AGENTS.md → SECURITY.md → the model) added so
scanners can mechanically follow the chain.

What this is, and what it is not

This is not a security audit. It is a working triage document
— the reference a triager holds against an inbound report to
decide whether the report is about a CloudStack vulnerability or
about caller misuse / operator misconfiguration / an out-of-scope
concern.

The draft was generated by an automated agentic security scan
being piloted by the ASF Security team; the discoverability work
is independent of any specific scan run.

How to review

§14 first. Each answer either confirms one (inferred) tag or
replaces the inferred claim with the correct one.
After that, please skim §3 (out-of-scope) and §13 (triage
dispositions) — those govern how a vulnerability report would
be triaged.

Reply edits / corrections inline on the PR, or to the original
security@apache.org thread, whichever fits the PMC's workflow.

🤖 Generated with Claude Code

Adds a draft project-level security threat-model document (draft-THREAT-MODEL.md) at repo root, improving discoverability for automated security scanners running against this repository. The file follows the rubric format used by several other ASF projects piloting security-model discoverability. The "draft-" prefix signals this is a proposal for the PMC to review, correct, or reject — not a finalised maintainer-blessed model. Every claim carries a provenance tag (documented / inferred / maintainer) so reviewers can see where each claim originates; §14 collects open questions for the maintainers. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

codecov · 2026-05-30T00:22:24Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 20.40%. Comparing base (7308dad) to head (0a0e38a).
⚠️ Report is 66 commits behind head on main.

Additional details and impacted files

@@             Coverage Diff              @@
##               main   #13293      +/-   ##
============================================
+ Coverage     18.10%   20.40%   +2.29%     
- Complexity    16752    18789    +2037     
============================================
  Files          6037     5757     -280     
  Lines        542796   520921   -21875     
  Branches      66456    60823    -5633     
============================================
+ Hits          98291   106300    +8009     
+ Misses       433460   403044   -30416     
- Partials      11045    11577     +532

Flag	Coverage Δ
uitests	`?`
unittests	`20.40% <ø> (+1.13%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Markdown / typos / table-shape fixes per the CI lint output. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

yadvr · 2026-06-01T07:19:43Z

There's a lot of details in the draft that needs a better set of eyes, so assigning @DaanHoogland @vishesh92 who're also PMC leads on the work.

potiuk · 2026-06-02T18:43:43Z

Thanks @DaanHoogland @yadvr @vishesh92 — agreed, let's make this (apache/cloudstack) the canonical project-level threat model and have the client/tooling repos inherit from it rather than each carrying a full copy.

Concretely, mirroring what we've done for other multi-repo PMCs:

apache/cloudstack/THREAT_MODEL.md is the single source of truth for the project-wide model: scope, trust boundaries, the management-server adversary model, in/out-of-scope classes, known non-findings, and triage dispositions.
The satellite repos (cloudstack-go, -cloudmonkey, -terraform-provider, -kubernetes-provider) get a short discoverability pointer — AGENTS.md → SECURITY.md → this model — plus, only where it adds something, a thin repo-specific addendum (e.g. the Go SDK's own input-trust surface) that references the parent instead of duplicating it.

So let's converge here first. None of the satellite PRs are merged, so re-pointing them to reference this model once its shape is settled is cheap — I'll repurpose those into pointer PRs (or close + reopen) once you're happy with the parent.

On "the fields we need": that's exactly the §14 "Open questions" section — each is a proposed answer for you to confirm, correct, or strike, grouped into waves so you can take a few at a time. Drop answers inline or here and I'll fold them in and promote the provenance tags. Happy to adjust the section set if CloudStack's shape calls for it.

…po copy Drop the standalone draft-THREAT-MODEL.md and wire the discoverability chain AGENTS.md -> SECURITY.md -> the project-wide model in apache/cloudstack (apache/cloudstack#13293), so scanners find one canonical model and this repo inherits it rather than duplicating it. Generated-by: Claude Code

potiuk · 2026-07-05T10:28:54Z

@shwstppr fair question — this one reviews differently from a code PR. A few notes to unstick it:

It's docs-only: a single THREAT_MODEL.md plus the AGENTS.md → SECURITY.md wiring. No code path to review, and the red CI is CloudStack's normal code/integration checks, which don't apply to a docs change — safe to ignore here.
It's a v0 draft to react to, not a finished document. Every inferred claim is tagged and collected into open questions at the end (§14) — so "reviewing" it is really answering those (confirm / correct / strike) and fixing anything factually wrong for CloudStack. Vishesh already did a solid pass on the global-setting names; that's exactly the shape of review that helps.
Copilot / automated review won't say anything useful about a prose threat model — agreed.
Merging is the ratification: once it's in, the model is the CloudStack PMC's document, owned and refined in place. It doesn't have to be perfect at merge — just correct enough that the PMC is comfortable it represents the project.

Happy to jump on any specific §14 question if that helps reviewers move.

— Jarek

DaanHoogland · 2026-07-05T13:27:25Z

@shwstppr , at only @vishesh92 , me and now you have reviewed. I would be very happy if we have more involvement, but on the other hand nothing here cannot be adjusted later.

vishesh92 · 2026-07-06T06:01:19Z

It looks good to me. The only thing left is Q37 which is to add more patterns based on the existing security issues to use here.

shwstppr

Looks good for start. We can refine this as we proceed.
Some suggestions from @DaanHoogland can be applied if no objections.

Co-authored-by: Abhishek Kumar <abhishek.mrt22@gmail.com> Co-authored-by: dahn <daan.hoogland@gmail.com>

Copilot

Pull request overview

Adds a project-level draft security threat-model document intended to help maintainers and automated security scanners quickly triage findings as in-scope vs out-of-scope for apache/cloudstack.

Changes:

Introduces draft-THREAT-MODEL.md describing scope, trust boundaries, adversary model, claimed/non-claimed properties, and triage dispositions.
Captures configuration-sensitive security posture details (e.g., Root CA strictness, proxy header verification, integration port exposure).
Includes a maintainer Q&A / resolution section intended to ratify or correct inferred claims.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

DaanHoogland · 2026-07-06T09:37:13Z

+  carry their own delta models.
+- **Commit:** `7308dad1` (HEAD of `main` at draft time).
+- **Date:** 2026-05-29.
+- **Authors:** ASF Security team draft, awaiting CloudStack PMC review.


I don’t see how this is still valid, we can add maintainers but in my view the statsu already was “reviewed”/“approved”, and not “draft". guess it slipped through the cracks.

@potiuk , can you advice?

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 4 comments.

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

vishesh92

lgtm. There might be some issues but let's get it merged and we can revisit once we have some output.

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 6 comments.

+> models are short *deltas* that inherit §3 / §4 / §7 from this
+> document and add only what each satellite uniquely introduces (`§4 B1`
+> reachability, the credential file shape, the wrapper-of-SDK contract,
+> etc.). The deltas live at `/tmp/claude/cloudstack-<repo>-threat-model-draft.md`.
+> The satellite clients' interfaces point **inward** at the management-server


+- **Authors:** ASF Security team draft, awaiting CloudStack PMC review.
+- **Status:** Draft — under maintainer review.


+- CloudStack does not document a maximum signed-API request size; assumed
+  to be servlet-container default (Jetty / Tomcat) *(inferred — §14 Q21)*.


+- API rate limiting is per-account via the global config knobs `api.throttling.*`
+  *(inferred — §14 Q22)*; an attacker with a valid API key can be rate-
+  limited at the application layer.


+**Q21.** API request size cap and cluster/agent RPC payload size cap —
+are these explicitly bounded, or "whatever Jetty / NIO defaults give"? **RESOLVED** *(maintainer: DaanHoogland)* — the UI server sets an explicit cap, `org.apache.cloudstack.ServerDaemon.DEFAULT_REQUEST_CONTENT_SIZE = 1048576` (1 MiB); for other components the sizes are capped by the upstream components used. *(maps to §6, §9)*


+  response to this draft; *(inferred)* = synthesized by the producer from
+  code structure or domain knowledge, awaiting PMC ratification (every
+  *(inferred)* tag has a matching §14 question).
+- **Draft confidence (provenance-tag tally):** 51 *(documented)* / 42


…tack threat model (#97) * Add draft project security threat-model document Adds a draft project-level security threat-model document (draft-THREAT-MODEL.md) at repo root, improving discoverability for automated security scanners running against this repository. The file follows the rubric format used by several other ASF projects piloting security-model discoverability. The "draft-" prefix signals this is a proposal for the PMC to review, correct, or reject — not a finalised maintainer-blessed model. Every claim carries a provenance tag (documented / inferred / maintainer) so reviewers can see where each claim originates; §14 collects open questions for the maintainers. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * Point to the project-wide CloudStack threat model instead of a per-repo copy Drop the standalone draft-THREAT-MODEL.md and wire the discoverability chain AGENTS.md -> SECURITY.md -> the project-wide model in apache/cloudstack (apache/cloudstack#13293), so scanners find one canonical model and this repo inherits it rather than duplicating it. Generated-by: Claude Code --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

…tack threat model (#149) * Add draft project security threat-model document Adds a draft project-level security threat-model document (draft-THREAT-MODEL.md) at repo root, improving discoverability for automated security scanners running against this repository. The file follows the rubric format used by several other ASF projects piloting security-model discoverability. The "draft-" prefix signals this is a proposal for the PMC to review, correct, or reject — not a finalised maintainer-blessed model. Every claim carries a provenance tag (documented / inferred / maintainer) so reviewers can see where each claim originates; §14 collects open questions for the maintainers. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * Point to the project-wide CloudStack threat model instead of a per-repo copy Drop the standalone draft-THREAT-MODEL.md and wire the discoverability chain AGENTS.md -> SECURITY.md -> the project-wide model in apache/cloudstack (apache/cloudstack#13293), so scanners find one canonical model and this repo inherits it rather than duplicating it. Generated-by: Claude Code * Exclude SECURITY.md + AGENTS.md from RAT These scaffold files carry an SPDX license header, but this repo's Apache RAT check doesn't scan headers embedded in Markdown, so list them in .rat-excludes. Generated-by: Claude Code * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Co-authored-by: dahn <daan.hoogland@gmail.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

…tack threat model (#212) * Add draft project security threat-model document Adds a draft project-level security threat-model document (draft-THREAT-MODEL.md) at repo root, improving discoverability for automated security scanners running against this repository. The file follows the rubric format used by several other ASF projects piloting security-model discoverability. The "draft-" prefix signals this is a proposal for the PMC to review, correct, or reject — not a finalised maintainer-blessed model. Every claim carries a provenance tag (documented / inferred / maintainer) so reviewers can see where each claim originates; §14 collects open questions for the maintainers. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * Point to the project-wide CloudStack threat model instead of a per-repo copy Drop the standalone draft-THREAT-MODEL.md and wire the discoverability chain AGENTS.md -> SECURITY.md -> the project-wide model in apache/cloudstack (apache/cloudstack#13293), so scanners find one canonical model and this repo inherits it rather than duplicating it. Generated-by: Claude Code * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Co-authored-by: dahn <daan.hoogland@gmail.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

…tack threat model (#292) * Add draft project security threat-model document Adds a draft project-level security threat-model document (draft-THREAT-MODEL.md) at repo root, improving discoverability for automated security scanners running against this repository. The file follows the rubric format used by several other ASF projects piloting security-model discoverability. The "draft-" prefix signals this is a proposal for the PMC to review, correct, or reject — not a finalised maintainer-blessed model. Every claim carries a provenance tag (documented / inferred / maintainer) so reviewers can see where each claim originates; §14 collects open questions for the maintainers. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * Point to the project-wide CloudStack threat model instead of a per-repo copy Drop the standalone draft-THREAT-MODEL.md and wire the discoverability chain AGENTS.md -> SECURITY.md -> the project-wide model in apache/cloudstack (apache/cloudstack#13293), so scanners find one canonical model and this repo inherits it rather than duplicating it. Generated-by: Claude Code * Apply suggestions from code review Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Co-authored-by: dahn <daan.hoogland@gmail.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

The project-wide security threat model merged (#13293) as draft-THREAT-MODEL.md, but the canonical discoverability name that scanners and satellite-repo SECURITY.md pointers follow is THREAT_MODEL.md. This renames the file to THREAT_MODEL.md and updates the in-repo SECURITY.md reference, making the pointer in apache/cloudstack-cloudmonkey (which already targets .../blob/main/THREAT_MODEL.md) resolve. The document's own review-status wording is unchanged. Generated-by: Claude Opus 4.8 (1M context)

(cherry picked from commit 4beab94)

The project-wide security threat model merged (apache#13293) as draft-THREAT-MODEL.md, but the canonical discoverability name that scanners and satellite-repo SECURITY.md pointers follow is THREAT_MODEL.md. This renames the file to THREAT_MODEL.md and updates the in-repo SECURITY.md reference, making the pointer in apache/cloudstack-cloudmonkey (which already targets .../blob/main/THREAT_MODEL.md) resolve. The document's own review-status wording is unchanged. Generated-by: Claude Opus 4.8 (1M context) (cherry picked from commit d2a3bd1)

Fix lint failures flagged on draft-threat-model PR

f792725

Markdown / typos / table-shape fixes per the CI lint output. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

yadvr requested review from DaanHoogland and vishesh92 June 1, 2026 07:16

DaanHoogland reviewed Jun 2, 2026

View reviewed changes