docs: Add SECURITY.md for Apache Lucene

[uschindler]

As the number of reported security issues also went up - and many of them were rejected, I used some time to create a SECURITY.md file with some basic instructions how to report security issues.

I am not sure if we should also add this to our web page, I'd like to start with the Git repo.

The text was mocked by Claude Fable 5 (Claude Max provided for ASF committers) and I rewrote + corrected it significantly. I tried to not add too much "UweSays style" texts :-)

I am free to discuss this, possibly again at Community over Code in October. But as mentioned already on the private list, I want to give it a go soon.

[dweiss]

LGTM. There seems to be one sentence where the syntax I don't fully comprehend... I added a suggestion which I think makes it clearer but I don't pretend to be as fluent in English as Claude. ;)

[uschindler]

I applied Dawid's small change, but I am not sure if this is well written. Maybe an English speaker should comment.

[uschindler]

I applied Dawid's small change, but I am not sure if this is well written. Maybe an English speaker should comment.

I reverted that again. Looks like the "it" is required, ClaudeSays™:

The original wording "the application embedding it is responsible" is the grammatical version: "embedding it" is a reduced relative clause meaning "the application that embeds Lucene", so the "it" (= Lucene) is required as the object of "embedding". Dropping it leaves "the application embedding", which reads as a noun phrase ("an embedding of applications"?) and no longer says what embeds what.

I have committed a better readable sentence which reads smoother:

Lucene's threat model assumes that the embedding application is responsible for authentication, authorization, network transport, and sanitization of all untrusted input.

So it is your idea, just in correct order.

[dweiss]

The original wording "the application embedding it is responsible" is the grammatical version: "embedding it" is a reduced relative clause meaning "the application that embeds Lucene", so the "it" (= Lucene) is required as the object of "embedding". Dropping it leaves "the application embedding", which reads as a noun phrase ("an embedding of applications"?) and no longer says what embeds what.

I understand the explanation. I also swear I read the sentence 10 times and couldn't get the meaning of it... :)

[uschindler]

I added another sentence that we do not have a bug bounty program (because this is always requested in reports. The sentence was copied from ASF pages.

[javanna]

+1

[msokolov]

"the application embedding it" ~~ "the application in which it is embedded" is how I was finally able to parse it

[uschindler]

"the application embedding it" ~~ "the application in which it is embedded" is how I was finally able to parse it

I don't undertstand that comment, Should I change it or is the current text ok? It is obvious if you read the previous sentence.

[msokolov]

"the application embedding it" ~~ "the application in which it is embedded" is how I was finally able to parse it
I don't undertstand that comment, Should I change it or is the current text ok? It is obvious if you read the previous sentence.

Yes it's fine, sorry to confuse the issue. I was just suggesting a possible alternative, that to me, is clearer. But either way is fine.

[uschindler]

"the application embedding it" ~~ "the application in which it is embedded" is how I was finally able to parse it
I don't undertstand that comment, Should I change it or is the current text ok? It is obvious if you read the previous sentence.

Yes it's fine, sorry to confuse the issue. I was just suggesting a possible alternative, that to me, is clearer. But either way is fine.

The sentence before has "downstream application" in its description, I could replace "embedding application" by "downstream application". This would not change structure of sentence (I don't like yours its harder for me to read). What do you think?

I am planning to merge this tomorrow (after 72 hours) to allow others to review. After that I will proceed with open security issues and comment to reporter with a reference to this file. Actually at moment there is only one open one which is long overdue, so this is why I want to hurry up.

[msokolov]

The sentence before has "downstream application" in its description, I could replace "embedding application" by "downstream application". This would not change structure of sentence (I don't like yours its harder for me to read). What do you think?

Yes maybe that's better? I think the word "embedding" has gotten somewhat hijacked by vector embeddings in my mind anyway.

[uschindler]

I cherry picked this into 10.x branch so we have the new file also in source code of new releases.