Security Model

A SECURITY_MODEL.md tells security review tools what matters in a repository: the system boundary, who is trusted, which properties must hold, which finding classes are reportable and how severe they are, and what is out of scope. It is policy context for reviewers, not executable instructions.

Why not SECURITY.md: GitHub reads a root, .github/, or docs/ SECURITY.md as the vulnerability disclosure policy, and a repository's own file replaces the getsentry org default. Writing scanner context there would replace the "report to security@sentry.io" page. Never create or overwrite SECURITY.md with this skill.

Script paths below are relative to this skill's directory (the one containing this file). Run them with the target repository as --repo.