# Security Model

Define, review, or update SECURITY_MODEL.md files that tell security review tools a...

- Repository: https://github.com/getsentry/skills (1107 stars)
- Category: Security
- License: Apache-2.0
- Last updated: 2026-10-26
- Runs scripts: yes, review before use

## Install

Claude Code: `npx skills add getsentry/skills --skill security-model -g -a claude-code -y`
Codex: `npx skills add getsentry/skills --skill security-model -g -a codex -y`
Cursor: `npx skills add getsentry/skills --skill security-model -g -a cursor -y`
Gemini CLI: `npx skills add getsentry/skills --skill security-model -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add getsentry/skills`

## Description

Define, review, or update SECURITY_MODEL.md files that tell security review tools a repository's threat model, trust boundaries, invariants, reportable finding classes, and exclusions. Use when asked to "write a security model", "threat model this repo for scanners", "define security review scope", "what counts as a vulnerability here", "update SECURITY_MODEL.md", "why did the scanner flag or miss this", or to check whether existing security guidance still matches the code. Not for running a security review or editing the SECURITY.md disclosure policy.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

<!--
Adapted from the define-security-policy skill in openai/codex-security
(https://github.com/openai/codex-security, Apache-2.0). Changes: policy file
renamed to SECURITY_MODEL.md, Node helper replaced with a Python resolver,
base-revision resolution for diff reviews, a stale-reference check, stable
invariant IDs, a finding class table, explicit parent overrides, dated
accepted-risk entries, and rules keeping suspected gaps and open questions
out of committed policy.
-->

# Security Model

A `SECURITY_MODEL.md` tells security review tools what matters in a repository: the system boundary, who is trusted, which properties must hold, which finding classes are reportable and how severe they are, and what is out of scope. It is policy context for reviewers, not executable instructions.

**Why not `SECURITY.md`:** GitHub reads a root, `.github/`, or `docs/` `SECURITY.md` as the vulnerability disclosure policy, and a repository's own file replaces the getsentry org default. Writing scanner context there would replace the "report to security@sentry.io" page. Never create or overwrite `SECURITY.md` with this skill.

Script paths below are relative to this skill's directory (the one containing this file). Run them with the target repository as `--repo`.

| Open when you need to... | Use |
| --- | --- |
| list, resolve, or check policies | `scripts/resolve_security_model.py` with `list`, `resolve`, or `check`. Exit 0 on success, 1 when `check` finds stale references, 2 on error. |
| wire a review skill or Warden prompt to read the policy | `references/consuming-policy.md` |

If `uv` or the script is unavailable, read each `SECURITY_MODEL.md` from the repository root down to the target directory yourself, root first, and grep for each backticked path and symbol in place of `check`. Tell the user the script did not run.

## 1. Find the Applicable Policies

Confirm the repository or component to cover. Inventory existing policies:

The rest: https://github.com/getsentry/skills/blob/HEAD/skills/security-model/SKILL.md