docs: refresh the security model against the current codebase

[oscerd]

What

A codebase-driven refresh of the project Security Model, reconciling it with the current 4.22.0-SNAPSHOT tree. No new security commitment is introduced — every change corrects, grounds, or indexes something already in the ratified model (strict-superset rule).

Why

The model's last substantive change was #23503 (2026-05-25). Verifying its load-bearing claims against the code surfaced two factual drifts and one posture improvement worth reflecting, plus two rubric sections that were still thin.

Changes

Factual corrections (code contradicts the doc):

• Profile default. The model stated Camel "defaults to the prod profile". It does not: DefaultConfigurationProperties.profile is null by default and ProfileConfigurer applies no profile when unset, leaving the security policy at warn. Both prod (→ fail) and dev (→ relaxed) are explicit opt-ins. Corrected across the out-of-scope, disclaimed-properties and deployment-hardening sections; prod remains the reference posture against which findings are judged.
• Header-filter namespace. Tightened the repeated "Camel* / org.apache.camel.*" wording to Camel* (matched case-insensitively). The org.apache.camel. prefix was deliberately removed in CAMEL-23543 (CAMEL-23543: Centralize and harden Camel* header filtering in DefaultHeaderFilterStrategy #23652) as a Camel 1.x artifact; the default CAMEL_FILTER_STARTS_WITH is {"Camel","camel"}.

Posture reflected:

• CAMEL-23543 (Camel 4.21). DefaultHeaderFilterStrategy now blocks the Camel* namespace by default, in both directions, for every consumer/producer — no per-component boilerplate. Updated the known-limitation and component-author guidance accordingly.

Rubric gaps filled:

• New Configuration variants that change the model section (profiles, security-policy levels, per-option opt-ins) consolidating the knobs that move the trust boundary.
• New machine-readable companion attachments/security-model.yaml — a derived triage index (entry-point trust, in/out-of-scope families, config variants, claimed/disclaimed properties, known non-findings, dispositions). The prose page remains canonical.

Examples refreshed:

• Added the published 2026 CVE wave to the existing in-scope classes (deserialization, header/bean-dispatch, auth bypass, information disclosure, back-end query injection). Every CVE ID was verified against the published advisory index — no embargoed IDs.

Notes for reviewers

• Docs-only (AsciiDoc page + a static YAML attachment); no Java, generated files, or catalog impact.
• Structural checks: all tables balanced, the YAML parses, no stale org.apache.camel filter claims remain.
• The prod-as-reference-posture framing was chosen deliberately over modelling the literal no-profile default; happy to flip to the more literal framing if you prefer.

---

Claude Code on behalf of oscerd

🤖 Generated with Claude Code

[github-actions]

🌟 Thank you for your contribution to the Apache Camel project! 🌟
🤖 CI automation will test this PR automatically.

🐫 Apache Camel Committers, please review the following items:

• First-time contributors require MANUAL approval for the GitHub Actions to run
• You can use the command /component-test (camel-)component-name1 (camel-)component-name2.. to request a test from the test bot although they are normally detected and executed by CI.
• You can label PRs using skip-tests and test-dependents to fine-tune the checks executed by this PR.
• Build and test logs are available in the summary page. Only Apache Camel committers have access to the summary.

⚠️ Be careful when sharing logs. Review their contents before sharing them publicly.

[gnodet]

Well-researched documentation refresh. The two key factual corrections are verified as accurate against the current codebase:

1. Profile default: DefaultConfigurationProperties.profile defaults to null (not prod), and ProfileConfigurer.configureMain() returns early when unset, leaving the security policy at warn. The change from "Stay on the default prod profile" to "Explicitly select the prod profile" is an important improvement.

2. Header filter namespace: CAMEL-23543 removed org.apache.camel. from CAMEL_FILTER_STARTS_WITH (current value: {"Camel", "camel"}). The documentation now correctly reflects this.

Minor notes (non-blocking):

• The YAML unsafe_deserialization.examples list includes CVE-2026-46590 but omits CVE-2026-43867 mentioned alongside it in the prose
• References to the YAML attachment don't use an Antora attachment$ macro for downloadable links
• project_version: 4.22.0-SNAPSHOT will need manual updates on release

This review was generated by an AI agent and may contain inaccuracies. Please verify all suggestions before applying.

Claude Code on behalf of Guillaume Nodet

[github-actions]

🧪 CI tested the following changed modules:

• docs

---

🔬 Scalpel shadow comparison — Scalpel: 1 tested, 0 compile-only — current: 0 all tested

Maveniverse Scalpel detected 1 affected modules (current approach: 0).

⚠️ Modules only in Scalpel (1)

• docs

Skip-tests mode would test 1 modules (1 direct + 0 downstream), skip tests for 0 (generated code, meta-modules)

Modules Scalpel would test (1)

• docs

ℹ️ Shadow mode — Scalpel observes but does not affect test execution. Learn more

---

⚙️ View full build and test results