Split the Security and Threat Model pages

src/main/javadoc/overview.html

@@ -99,7 +99,7 @@ <h1>
       <img src="org/apache/commons/xml/secure/doc-files/leaf.svg" style="height: 1em; padding-right: 0.25em" alt="leaf">Usage
     </h1>
     <p>
-      To add the library to your build, see <a href="dependency-info.html">Maven Coordinates</a>. (Maven Coordinates)[dependency-info.html]
+      To add the library to your build, see <a href="../dependency-info.html">Maven Coordinates</a>.
     </p>
     <p>
       Every factory method in
@@ -112,7 +112,7 @@ <h1>
       <h2>Supported Runtimes</h2>
       <p>The library requires OpenJDK 8 or later (or a JDK distribution built from it), or Android API level 26 or later.</p>
       <p>
-        The security guarantees are defined only on the OpenJDK family (see the <a href="threat_model.html">Threat Model</a>). No version of Android supports
+        The security guarantees are defined only on the OpenJDK family (see the <a href="../threat_model.html">Threat Model</a>). No version of Android supports
         <code>FEATURE_SECURE_PROCESSING</code>
         (so states <a href="https://developer.android.com/reference/javax/xml/parsers/DocumentBuilderFactory#setFeature%28java.lang.String,%20boolean%29">Android’s
           own documentation</a>), so the library secures the platform’s parsers as best-effort. Android’s
@@ -285,7 +285,7 @@ <h2>Stylesheets and Schemas</h2>
         <a href="https://docs.oracle.com/en/java/javase/25/docs/api/java.xml/javax/xml/transform/sax/SAXSource.html"><code>SAXSource</code></a>
         . A stylesheet also chooses where the transform writes (
         <code>xsl:result-document</code>):
-        the securing governs reads only, so restrict output destinations yourself when running an untrusted stylesheet (see the <a href="threat_model.html">Threat
+        the securing governs reads only, so restrict output destinations yourself when running an untrusted stylesheet (see the <a href="../threat_model.html">Threat
           Model</a>).
       </p>
     </section>
@@ -306,7 +306,7 @@ <h2>Transformer Handlers and Filters</h2>
         carrying the same securing as the standard entry points: runtime
         <code>document()</code>
         resolves to empty content, and a filter with no caller-set parent parses its input through a secured reader. The SAX events you feed into a handler, and
-        a parent reader you set on a filter, are your own configuration, like any caller-supplied parser. See the <a href="threat_model.html">Threat Model</a>
+        a parent reader you set on a filter, are your own configuration, like any caller-supplied parser. See the <a href="../threat_model.html">Threat Model</a>
         for the exact scope.
       </p>
     </section>
@@ -523,7 +523,7 @@ <h1>
       A resolver floor has neither problem:
       it covers every channel on every supported implementation,
       and it yields to a caller’s resolver without consulting the properties.
-      The <a href="threat_model.html">Threat Model</a> documents the resulting contract.
+      The <a href="../threat_model.html">Threat Model</a> documents the resulting contract.
     </p>
   </section>
 </body>

src/site/markdown/security.md

@@ -0,0 +1,58 @@
+<!--
+Licensed to the Apache Software Foundation (ASF) under one or more
+contributor license agreements.  See the NOTICE file distributed with
+this work for additional information regarding copyright ownership.
+The ASF licenses this file to You under the Apache License, Version 2.0
+(the "License"); you may not use this file except in compliance with
+the License.  You may obtain a copy of the License at
+
+     https://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+-->
+
+# Apache Commons Secure XML Security
+
+For information about reporting or asking questions about security,
+please see [Apache Commons Security](https://commons.apache.org/security.html).
+
+This page lists all security vulnerabilities fixed in released versions of this component.
+
+Please note that binary patches are never provided.
+If you need to apply a source code patch,
+use the building instructions for the component version that you are using.
+
+If you need help on building this component,
+or other help on following the instructions to mitigate the known vulnerabilities listed here,
+please send your questions to the public [user mailing list](mail-lists.html).
+
+If you have encountered an unlisted security vulnerability or other unexpected behavior that has security impact,
+or if the descriptions here are incomplete,
+please report them privately to the Apache Security Team.
+Thank you.
+
+## Supported Versions
+
+Security fixes are applied to the **1.x** release line.
+
+## Security Model
+
+This section amends the [Apache Commons security model](https://commons.apache.org/security.html#Security_Model) for this component.
+
+Read the [Apache Commons Secure XML Threat Model](threat_model.html):
+it states what the securing guarantees,
+what falls outside it,
+and the disposition a report receives.
+
+## Security Vulnerabilities
+
+None.
+
+## Safe Deserialization
+
+For information about safe deserialization,
+please see [Safe Deserialization](https://commons.apache.org/io/description.html#Safe_Deserialization).