docs(STM): refactor threat model - clarify process, remove findings

[dkamburov]

Description

This pull request updates the security documentation to improve the privacy and clarity of threat modeling and findings tracking. The main changes are the removal of public enumerations of open security findings and the introduction of a process-focused approach, ensuring that unfixed vulnerabilities are not disclosed prematurely. The documentation now emphasizes analysis methodology, private tracking of findings, and clearer references to relevant policies.

Key changes:

1. Findings and Threats Handling

• Removed the public enumeration of security findings from review-template.md and threat-model.md, replacing them with a process for private tracking and post-fix disclosure. This reduces the risk of exposing unfixed vulnerabilities. [1] [2]
• Added a new section describing how findings are handled privately, including steps for recording, triage, disposition, release gating, disclosure, and re-analysis triggers.

2. Analysis Methodology and Documentation Structure

• Updated the threat model to focus on analysis areas and boundaries, describing what is analyzed for each package and boundary, rather than listing individual threats and findings.
• Clarified that accepted residual risks are tracked privately and surfaced publicly only when relevant for consumers, removing their previous public listing.

3. References and Process Documentation

• Improved references to related documentation, including links to SECURITY.md, CONTRIBUTING.md, and the review template, making it easier to find relevant policies and processes.
• Updated internal links and section references for clarity and accuracy, such as referencing the correct section on consumer responsibilities.

These changes collectively strengthen the security posture by ensuring responsible disclosure and clearer documentation of the security review and threat modeling process.

[Copilot]

Pull request overview

This PR refactors the security threat model and review template documentation to avoid publicly enumerating open security findings, shifting the docs to a process- and analysis-area-focused approach aligned with responsible disclosure.

Changes:

• Replaced detailed, public “threats/findings” enumerations with “analysis areas” describing what is assessed per boundary/package.
• Added a dedicated “How findings are handled” section describing private tracking, triage, release gating, disclosure, and re-analysis triggers.
• Updated the security review template to use a generic findings register format (one row per finding) and to point to the findings-handling process.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
docs/security/threat-model.md	Reframes the threat model around analysis areas and documents a private findings handling process plus updated references.
docs/security/review-template.md	Removes public findings lists and introduces a generic findings register with guidance to keep open findings private.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.