[DOC] Add threat model

AGENTS.md

@@ -49,6 +49,10 @@ Get reviewer attention before changing:
 - `kyuubi-common/.../config/KyuubiConf` — config registry; changes require regenerating `settings.md`.
 - `kyuubi-server/.../api/v1/` — public REST surface; add auth checks before exposing.
 
+### Security Reviews
+
+Before classifying a security finding, read `SECURITY.md` and `docs/security/threat-model.md`. Apply the documented scope, deployment profiles, and trust boundaries.
+
 ## Build and Test
 
 Use the bundled Maven wrapper (`build/mvn`).

SECURITY.md

@@ -0,0 +1,35 @@
+<!--
+  Licensed to the Apache Software Foundation (ASF) under one or more
+  contributor license agreements.  See the NOTICE file distributed with
+  this work for additional information regarding copyright ownership.
+  The ASF licenses this file to You under the Apache License, Version 2.0
+  (the "License"); you may not use this file except in compliance with
+  the License.  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+-->
+
+# Security policy
+
+## Reporting a vulnerability
+
+To report a security vulnerability in Apache Kyuubi, follow the ASF security
+process at <https://www.apache.org/security/>. Reports can be sent privately to
+security@kyuubi.apache.org.
+
+## Threat model
+
+Apache Kyuubi's security threat model, including its assets, trust boundaries,
+deployment assumptions, security goals, and in-scope and out-of-scope threats,
+is documented at:
+
+<https://kyuubi.readthedocs.io/en/master/security/threat-model.html>
+
+Automated security scanning agents should consult that document for the
+project's in-scope and out-of-scope declarations before reporting issues.

docs/security/index.rst

@@ -21,9 +21,9 @@ Securing Kyuubi involves enabling authentication(authn), authorization(authz) an
 .. toctree::
     :maxdepth: 2
 
+    Threat model <threat-model>
     Authentication <authentication>
     Authorization <authorization/index>
     kinit
     hadoop_credentials_manager
     internal_secure_access
-