This file is read by automated agents (security scanners, code analyzers, AI assistants) operating on this repository. It points them at the human-authored references they should consult before producing output.
Security model: SECURITY.md, which links to the canonical model document at https://tomcat.apache.org/security-model.html.
Agents that scan this repository should consult the linked security model for the project's threat model, in-scope / out-of-scope declarations, and known non-findings before reporting issues.