[dev] ODF Toolkit enrolment in Anthropic’s OSS Scanner

Hi all,

I’ve submitted a PR to enrol ODF Toolkit in Anthropic’s OSS Scanner
<https://red.anthropic.com/oss-scanner/>, which offers free, periodic
security scans for participating open-source projects:

https://github.com/anthropics/oss-scanner/pull/545

The submission includes an offline Docker build and a project-specific
threat model covering untrusted ODF documents, ZIP/XML processing, resource
resolution and validator uploads. The local build and offline test checks
have passed.

If accepted, we would receive reports privately, with reproduction steps
and proposed patches where available. These reports are AI-generated and
have not undergone human review, so we would still need to reproduce and
assess any findings ourselves.

For background, this Heise article explains the initiative
<https://www.heise.de/en/news/Anthropic-scans-open-source-projects-for-vulnerabilities-for-free-11483011.html>
.

Best,
Svante

PS: I will continue on the release as soon as the issues are
reviewed (4-eyes principle) - but not before Friday afternoon, likely
Monday next week

-- 
To unsubscribe e-mail to: dev+unsubscribe@odftoolkit.org
Problems? https://www.libreoffice.org/get-help/mailing-lists/how-to-unsubscribe/
Posting guidelines + more: https://wiki.documentfoundation.org/Netiquette
List archive: https://listarchives.odftoolkit.org/dev/
Privacy Policy: https://www.documentfoundation.org/privacy