@iamamoose Mark, you said "outside of the threat model". Is that threat model documented anywhere? I ask because I think the threat model could be used to filter security issues and I would like to see Apache's