This file is read by automated agents (security scanners, code analyzers, AI assistants) operating on this repository. It points them at the human-authored references they should consult before producing output.
Security model: SECURITY.md -> THREAT_MODEL.md
Agents that scan this repository should consult SECURITY.md and the linked
THREAT_MODEL.md for the project's threat model before reporting issues. Note
that CXF is a framework: it provides security mechanisms (WS-Security, TLS
conduits, authorization interceptors, XML-processing limits) and many
properties are conditional on how the integrator configures them. The model
covers the runtime SOAP/JAX-WS and REST/JAX-RS pipeline, WS-Security
processing, XML parsing (XXE/DoS), the SSRF surface of remote
WSDL/schema/MTOM resolution, and JAX-RS provider deserialization.