Skip to content

chore: update security model to define additional scope boundaries - #3845

Open
sungwy wants to merge 1 commit into
apache:mainfrom
sungwy:update-security-model
Open

chore: update security model to define additional scope boundaries#3845
sungwy wants to merge 1 commit into
apache:mainfrom
sungwy:update-security-model

Conversation

@sungwy

@sungwy sungwy commented Aug 24, 2026

Copy link
Copy Markdown
Collaborator

Rationale for this change

Update SECURITY-THREAT-MODEL.md to introduce additional scope boundaries that define security issues in iceberg-python.

This updated boundary excludes the following categories of issues from being labeled as a security issue in PyIceberg:

  • Reports requiring an authorized table writer or maintainer
  • Resource exhaustion, allocation amplification, and algorithmic complexity (categorized as a bug)
  • Out-of-bounds access and native memory-safety findings (categorized as a bug)
  • Configuration loaded from documented default locations (intended behavior)
  • Provenance of the table being read (defined as reader's responsibility)

Are these changes tested?

Markdown only change - no testing required.

Are there any user-facing changes?

No

@sungwy
sungwy requested review from kevinjqliu and a lite review from Copilot August 24, 2026 22:50

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Updates SECURITY-THREAT-MODEL.md to more explicitly define PyIceberg’s security scope boundaries and calibrate which report classes should be treated as vulnerabilities vs. bugs/hardening work.

Changes:

  • Clarifies that PyIceberg is not an isolation boundary between tenants/principals sharing a single process, and reframes when client-side state sharing is security-relevant.
  • Expands “Usually Out of Scope / Non-Security by Default” with additional categories (authorized-writer reports, resource exhaustion/complexity, native memory safety, default config discovery, dataset provenance).
  • Updates scanner calibration guidance to reflect the new scope boundaries.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Comment thread SECURITY-THREAT-MODEL.md
Comment on lines +276 to +280
Iceberg Python loads configuration from documented default locations, including
`.pyiceberg.yaml` resolved from the working directory, the user home directory,
and `PYICEBERG_HOME`, together with `PYICEBERG_`-prefixed environment
variables. This resolution order is public, documented behavior and follows the
same pattern as configuration loading in widely used tooling across the
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants