From 91416513002a835be09ae1a4e6a6ae7bb03e2761 Mon Sep 17 00:00:00 2001
From: Jarek Potiuk <jarek@potiuk.com>
Date: Sun, 5 Jul 2026 14:17:06 +0200
Subject: [PATCH] Add Security section to AGENTS.md linking the security model

Adds a Security section to AGENTS.md so an automated scan agent can
discover the project's security model via the conventional
AGENTS.md -> SECURITY.md chain. SECURITY.md already points at the
commons-xml threat model; this only adds the AGENTS.md -> SECURITY.md
pointer so the chain resolves end to end. No model content changes.

Assisted-By: Claude Code (Claude Opus 4.8)
---
 AGENTS.md | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/AGENTS.md b/AGENTS.md
index c0b0db0..9b78cd5 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -52,4 +52,12 @@ Guidance for AI coding agents working in this repository.
 
 ### Commits
 
-- Use the `Assisted-By:` trailer (not `Co-Authored-By:`).
\ No newline at end of file
+- Use the `Assisted-By:` trailer (not `Co-Authored-By:`).
+
+## Security
+
+Security model: [SECURITY.md](./SECURITY.md)
+
+Agents that scan this repository should consult `SECURITY.md` for the
+project's threat model, in-scope / out-of-scope declarations, and known
+non-findings before reporting issues.