Apache Shiro's security model and disclosure process are published on the project website rather than in the repository:
- Threat and security model: https://shiro.apache.org/security-model.html
- Security policy, vulnerability reporting, past advisories and CVEs: https://shiro.apache.org/security-reports.html
- Supported versions
- Verifying releases
- Security self-assessment
- Dependency policy
- Security Insights
The project website is the authoritative source; this file
exists so agents and tooling that look for SECURITY.md in
the repository can mechanically follow the link to the
canonical documents.
Report undisclosed security vulnerabilities privately to [email protected]. Do not open public issues, pull requests or discussions for vulnerabilities that have not been fixed and announced.