dubbo
AGENTS.md42k starsChanged 3 years agoApache-2.0View on GitHub
This project maintains a living threat model at docs/threat-model.md. The threat model describes: Before reporting, consult the threat model to determine whether the finding: The threat model includes a machine-readable companion structure (§15) and a triage disposition table (§13) that can be used to automate report classification. Key triage dispositions:
We split this AGENTS.md into the rules it gives an agent
1 rule. About 0 are common, 1 is distinctive, and 0 are very specific to this project.
≈0
Common · estimate
Many files like this have a rule of this kind.
≈1
Distinctive · estimate
This author's own choices. Worth a look.
0
Very specific
Tied to their project's names, files or tools. Probably skip.
- Common
- Distinctive
- Very specific
- Distinctive: line 17
Before reporting, consult the threat model to determine whether the finding:
≈ “Common” is an estimate: at least 1 in 5 of the 36,368 AGENTS.md files we read have a rule of the same kind, not the same words. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.
Files
Threat Model
This project maintains a living threat model at docs/threat-model.md.
The threat model describes:
- The implicit contract between Apache Dubbo and its downstream users
- Trust boundaries, adversary model, and assumptions about the deployment environment
- Security properties Dubbo provides (conditional on configuration)
- Security properties Dubbo explicitly does not provide
- Downstream responsibilities for integrators
- Known misuse patterns and recurring false positives
- Triage dispositions for classifying vulnerability reports
For vulnerability reporters
Before reporting, consult the threat model to determine whether the finding:
- Violates a claimed security property (§8) — report to security@dubbo.apache.org
- Falls under an out-of-scope or by-design disclaimer (§3, §9) — will be closed citing the threat model
- Matches a known non-finding (§11a) — already documented as a false positive
For automated security tools
The threat model includes a machine-readable companion structure (§15) and a triage disposition table (§13) that can be used to automate report classification.
Key triage dispositions:
| Disposition | When to apply |
VALID | Violates §8 property via in-scope adversary |
OUT-OF-MODEL: trusted-input | Requires attacker control of trusted registry/config |
OUT-OF-MODEL: adversary-not-in-scope | Requires excluded attacker capability |
BY-DESIGN: property-disclaimed | Concerns property explicitly disclaimed in §9 |
KNOWN-NON-FINDING | Matches documented false positive in §11a |
Trending
Quiet since March.about the whole repository
Who's talking about apache/dubbo
- Joson Wong“Apache Dubbo微服务治理”YouTube · May 16, 2020 · 259 views
- GitHub Daily Trend AI Podcast“GitHub - apache/dubbo: The java implementation of Apache Dubbo. An RPC and microservice framework.”YouTube · Sep 21, 2024 · 232 views
- apache/skywalking-java“add plugin for dubbo3”GitHub · Nov 23, 2021 · 9 reactions
- MuYunyun/blog“拼多多内推(长期有效)”GitHub · Mar 19, 2019 · 9 reactions
- apache/dubbo-spi-extensions“Dubbo SPI Extensions Tasks（扩展库规划）”GitHub · Nov 5, 2023 · 4 reactions
The biggest 5 of 23 mentions linking to the repository that our crawl found. Each line is their own headline.
See all 23
Talked about on GitHub, Bluesky, Stack Overflow, YouTube and Hacker News (23 times).
On GitHub · 14
- Nov 23, 2021add plugin for dubbo3 — apache/skywalking-java9 reactions · 28 comments
- Mar 19, 2019拼多多内推(长期有效) — MuYunyun/blog9 reactions · 2 comments
- Nov 5, 2023Dubbo SPI Extensions Tasks（扩展库规划） — apache/dubbo-spi-extensions4 reactions · 19 comments
- Oct 11, 2023[Serialization] add fury serialization framework to dubbo — apache/dubbo-spi-extensions3 reactions · 2 comments
- Jun 9, 2023fix: CollectionUtils#computeIf lock bug — baomidou/mybatis-plus3 reactions
9 more on GitHub
- Apr 14, 2023当当 dubbox 支持 — GuanceCloud/dd-trace-java3 reactions · 4 comments
- Dec 22, 2023Feat: Add github action configuration to automatically manage projects — alibaba/spring-cloud-alibaba2 reactions · 2 comments
- Sep 1, 2021nacos 的 dubbo 链接搜索貌似有问题 — apache/dubbo-js2 reactions
- Mar 27, 2026False positive: java/potentially-weak-cryptographic-algorithm flags secure Elliptic Curve algorithms (EC, ECDSA, ECDH, EdDSA, etc.) — github/codeql1 reaction · 1 comment
- Apr 23, 2025[MBUILDCACHE-123] do not set projectExecutions if cacheState is disabled — apache/maven-build-cache-extension1 reaction · 4 comments
- Aug 25, 2023Optimize the Current ConcurrentHashMap usage — apache/pekko1 reaction · 4 comments
- Apr 20, 2023add Gateway mode extension — apache/dubbo-spi-extensions1 reaction · 3 comments
- Dec 2, 2020There is a vulnerability in XStream1.4.10 ,upgrade recommended — apache/dubbo-spi-extensions1 reaction
- Mar 8, 2023Bump dubbo from 2.7.15 to 2.7.21 — pjfanning/incubator-shenyu0 reactions · 1 comment
On Bluesky · 3
- Mar 27, 2026This is useful from the initial looks of it. https://github.com/apache/dubbo — @dhinojosa.mastodon.social.ap.brid.gy1 likes and repost
- Sep 20, 2024📦 apache / dubbo ⭐ 40,357 (+12) 🗒 Java The java implementation of Apache Dubbo. An RPC and microservice framework. — @github-trending.bsky.social1 likes and repost · 1 reply
- Mar 20, 2024Apache Dubbo est un système de RPC Open Source conçu pour les architectures microservices. Initié par Alibaba, il vise principalement à… — @bearstech.com1 likes and repost
On Stack Overflow · 3
- Sep 26, 2024Unable to canonicalize address 127.0.0.1/<unresolved>:2181 because it's not resolvable0 votes
- Dec 3, 2022Getting ERROR Failed to execute goal org.apache.maven.plugins:maven-surefire-plugin:3.0.0-M5:test (default-test) on project0 votes
- Dec 3, 2022Getting ERROR Failed to execute goal org.apache.maven.plugins:maven-surefire-plugin:3.0.0-M5:test (default-test) on project0 votes · 1 answer
On YouTube · 2
- May 16, 2020Apache Dubbo微服务治理 — Joson Wong259 views
- Sep 21, 2024GitHub - apache/dubbo: The java implementation of Apache Dubbo. An RPC and microservice framework. — GitHub Daily Trend AI Podcast232 views
On Hacker News · 1
- Aug 8, 2024Dubbo: A Robust Java RPC and Microservice Framework1 point · 1 comment
Where files are headingNew AGENTS.md files have more rules about keeping secrets out of the code, and fewer about code style.
Of the AGENTS.md files we read, the 28,693 first seen in the last six months, against the older ones: the kind of rule that gained most share, and the kind that lost most. About files like this in general, not this one, and an estimate, since a kind is a pattern in the words.
Does it work?
Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.
No reviews yet
People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.
- It worked
- Partly
- It didn't
Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.
Your trail
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
Now do this for your own.
Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.