[CALCITE-7605] Add threat model

.ratignore

@@ -13,6 +13,8 @@
 **/data.txt
 **/data2.txt
 .idea/vcs.xml
+AGENTS.md
+SECURITY.md
 example/csv/src/test/resources/smoke_test.sql
 
 # TODO: remove when pom.xml files are removed

AGENTS.md

@@ -0,0 +1 @@
+Security model: [SECURITY.md](./SECURITY.md)

SECURITY.md

@@ -0,0 +1,13 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+`apache/calcite` follows the [Apache Software Foundation security process](https://www.apache.org/security/).
+Please report suspected  vulnerabilities privately to `security@apache.org`; do not open public
+GitHub issues or pull requests for security reports.
+
+## Threat Model
+
+What the project treats as in scope and out of scope, the security
+properties it provides and disclaims, the adversary model, and how
+findings are triaged are documented in [THREAT_MODEL.md](site/_docs/security_threat_model.md).