chore: update security model to define additional scope boundaries - #3845
Merged
kevinjqliu merged 1 commit intoAug 25, 2026
Merged
chore: update security model to define additional scope boundaries#3845kevinjqliu merged 1 commit into
kevinjqliu merged 1 commit into
Conversation
Copy link
Copy Markdown
Collaborator
Sorry, something went wrong.
Copy link
Copy Markdown
Contributor
There was a problem hiding this comment.
Pull request overview
Updates SECURITY-THREAT-MODEL.md to more explicitly define PyIceberg’s security scope boundaries and calibrate which report classes should be treated as vulnerabilities vs. bugs/hardening work.
Changes:
- Clarifies that PyIceberg is not an isolation boundary between tenants/principals sharing a single process, and reframes when client-side state sharing is security-relevant.
- Expands “Usually Out of Scope / Non-Security by Default” with additional categories (authorized-writer reports, resource exhaustion/complexity, native memory safety, default config discovery, dataset provenance).
- Updates scanner calibration guidance to reflect the new scope boundaries.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Sorry, something went wrong.
Comment thread
SECURITY-THREAT-MODEL.md
Comment on lines
+276
to
+280
| Iceberg Python loads configuration from documented default locations, including | ||
| `.pyiceberg.yaml` resolved from the working directory, the user home directory, | ||
| and `PYICEBERG_HOME`, together with `PYICEBERG_`-prefixed environment | ||
| variables. This resolution order is public, documented behavior and follows the | ||
| same pattern as configuration loading in widely used tooling across the |
kevinjqliu
approved these changes
Aug 25, 2026
kevinjqliu
left a comment
Copy link
Copy Markdown
Contributor
There was a problem hiding this comment.
LGTM, we have discussed about these offline.
Thanks for adding them here
Sorry, something went wrong.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Reviewers
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Rationale for this change
Update SECURITY-THREAT-MODEL.md to introduce additional scope boundaries that define security issues in iceberg-python.
This updated boundary excludes the following categories of issues from being labeled as a security issue in PyIceberg:
Are these changes tested?
Markdown only change - no testing required.
Are there any user-facing changes?
No