Post #3852222

@florenciocano@infosec.exchange right! That's actually part of the solution. Each project is responsible for creating their own threat model and we've been working with them to ensure they're published and llm-findable, not just from a list on security.apache.org but in SECURITY.md files etc