From d847a0b4535f7104a8e69e25c5bbff0cdf55a7f1 Mon Sep 17 00:00:00 2001
From: Volker Dusch <247397+edorian@users.noreply.github.com>
Date: Tue, 11 Aug 2026 20:19:15 +0200
Subject: [PATCH 1/2] Propose Trust/Thread model section in SECURITY.md

Clarify the trust and execution boundaries for phpcs
---
 SECURITY.md | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/SECURITY.md b/SECURITY.md
index 93b86d8..14c524a 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -1,5 +1,16 @@
 # Security Policy
 
+## Trust model
+
+PHP_CodeSniffer standards and configuration are not sandboxed.
+
+Rulesets may load and execute PHP code supplied by the analyzed project, including custom sniffs and autoloaded files. 
+Repository-local PHPCS configuration should therefore be treated as executable project code.
+
+Running PHP_CodeSniffer against an untrusted or attacker-modifiable checkout must be treated in the same way as running that checkout's tests, build scripts, or other development tooling.
+
+CI environments processing untrusted contributions are responsible for appropriate isolation, including restricting access to credentials, secrets, privileged services, and sensitive network resources.
+
 ## Supported Versions
 
 For all repositories in the PHPCSStandards organisation, the latest patch version of the current major is supported for security updates.

From 7775f377a0e6f22ebb7c65325b045743b9c8e77c Mon Sep 17 00:00:00 2001
From: Volker Dusch <247397+edorian@users.noreply.github.com>
Date: Wed, 12 Aug 2026 11:22:43 +0200
Subject: [PATCH 2/2] Tidy

---
 SECURITY.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/SECURITY.md b/SECURITY.md
index 14c524a..0ae0f30 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -4,7 +4,7 @@
 
 PHP_CodeSniffer standards and configuration are not sandboxed.
 
-Rulesets may load and execute PHP code supplied by the analyzed project, including custom sniffs and autoloaded files. 
+Rulesets may load and execute PHP code supplied by the analyzed project, including custom sniffs and autoloaded files.
 Repository-local PHPCS configuration should therefore be treated as executable project code.
 
 Running PHP_CodeSniffer against an untrusted or attacker-modifiable checkout must be treated in the same way as running that checkout's tests, build scripts, or other development tooling.