[yfedoseev]

Edit projects/pdf_oxide

Follow-up to #16, in response to the opt-in email about GitHub Security Advisories.

• project.yaml: add output_format — email stays at low, github_security_advisory set to medium.
• threat_model.md: add a severity-rating section so reports are rated the way the maintainer would rate them.

Private vulnerability reporting is enabled on https://github.com/yfedoseev/pdf_oxide and listed in its SECURITY.md.

• I am a core maintainer of this project.
• tools/validate.py passes locally.
• I accept the OSS Scanner terms

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[github-actions]

Enrolment triage: projects/pdf_oxide

Repository: yfedoseev/pdf_oxide at main · opened by yfedoseev

	Check	Result
✅	Repository	created 11 months ago, last push today
ℹ️	Stars / forks	1,150 stars · 147 forks · 2 watching
ℹ️	Outside participants	12 people from outside the project opened 22 of the last 100 issues and pull requests
ℹ️	Criticality score	0.66 on the OpenSSF scale of 0 to 1 signals created_since 11, updated_since 0, contributor_count 39, org_count 6, commit_frequency 32.5, recent_releases_count 84, closed_issues_count 108, updated_issues_count 137, comment_frequency 21.3, dependents_count 241
ℹ️	Package rank	by downloads: pdf-oxide is 9,005th on PyPI · nothing from this repository found in the top 10,000 on npm or the top 1,000 on crates.io
✅	License	Apache-2.0
✅	Opened by an active maintainer	owns the repository; 100+ commits in the last 12 months; #1 contributor
✅	Contact in SECURITY.md	yfedoseev@gmail.com is in SECURITY.md
ℹ️	OSS-Fuzz	not found in OSS-Fuzz
ℹ️	.oss-scanner/ in the repository	not present; the Dockerfile is in this pull request
✅	Pull request scope	only this project's directory
✅	tools/validate.py	passes
✅	Checklist	all 3 ticked

_{Automated, from public data, to help reviewers. Enrolment is decided case by case against the criteria. If you think we got something wrong, please tell us in a reply.}