[saltas888]

Why

We plan to enroll the SDK in Anthropic's OSS Scanner, a free service that scans open-source projects for vulnerabilities. To enroll, the project needs:

• a security contact listed in SECURITY.md or a similar file. Anthropic checks this before sending reports. The SDK has no SECURITY.md today.
• a Dockerfile that builds the project so the scanner can run it without network access.
• an optional threat model that tells the scanner what is in scope and how we rate severity.

The enrollment itself is a separate pull request on anthropics/oss-scanner. It pins the stable branch, so this PR has to merge first.

What changed

• SECURITY.md: same reporting channels, timeline and reporter credit rules as the Infrahub security policy, with the GitHub advisory link pointing to this repo. Server vulnerabilities are sent to the Infrahub policy.
• .oss-scanner/Dockerfile: Python 3.14.10, uv sync --all-groups --all-extras, then runs the unit tests without failing the build, as Anthropic's template recommends. UV_NO_SYNC and UV_OFFLINE keep uv run from trying to sync during the offline scan.
• .oss-scanner/threat_model.md: what the SDK does, where untrusted input enters, what is trusted by design (Python code and Jinja2 template files from Git repositories), what is out of scope, and a severity rubric.

How to review

Please check these points in particular:

• Severity rubric in threat_model.md. It is a proposal and decides which reports reach us, because we only receive high and critical.
• How we prepare fixes. The Infrahub policy has a section on where fixes are prepared by severity (private repository for critical). I left it out because it is not known whether the SDK follows the same process. Add it if it does.
• Private vulnerability reporting must be turned on for this repo (Settings, Code security) for the "Report a Vulnerability" link and for Anthropic's GitHub reports to work. I could not check this setting.

How to test

Built and run in this session (with local proxy settings that are not part of the files):

docker build -f .oss-scanner/Dockerfile -t sdk-scan .
# build log: 2063 passed, 1 xfailed
docker run --rm --network none sdk-scan bash -c 'infrahubctl --help && uv run pytest -q tests/unit/sdk/checks'
# 6 passed

Markdown lint: rumdl check SECURITY.md .oss-scanner/threat_model.md passes.

When squash merging, remove the session link line from the first commit's message.

Checklist

• Tests added/updated (not needed, no code change)
• Changelog entry added (not needed, no change to the SDK)
• External docs updated (not needed)
• Internal .md docs updated (not needed)
• I have reviewed AI generated content

🤖 Generated with Claude Code

[cloudflare-workers-and-pages]

Deploying infrahub-sdk-python with    Cloudflare Pages

Latest commit:	b606ba7
Status:	✅  Deploy successful!
Preview URL:	https://564bab5b.infrahub-sdk-python.pages.dev
Branch Preview URL:	https://feat-gracious-sagan-wfzuii.infrahub-sdk-python.pages.dev

View logs