Before making security-sensitive runtime changes, read SECURITY_THREAT_MODEL.md.
Security-sensitive runtime changes include authentication, authorization, anonymous paths, native Nessie REST APIs, Iceberg REST APIs, catalog/object-store credential vending, request signing, secrets handling, persistence backend assumptions, reverse-proxy behavior, TLS/deployment defaults, and GC/admin tooling behavior that affects repository or data-lake authority.
When such a change modifies Nessie's security contract, update SECURITY_THREAT_MODEL.md in the same change or explicitly document why no threat-model update is needed.
Security vulnerability reports should follow SECURITY.md.