[leerho]

Adds a SECURITY.md, adapted from the one in datasketches-cpp (apache/datasketches-cpp#545), so both libraries make the same commitments.

It covers:

• Reporting: report privately to security@apache.org or private@datasketches.apache.org, not through public issues or PRs.
• Supported versions and published vulnerabilities: same text as C++.
• Security model:
  • Deserialization is in scope. heapify(), wrap(), writableWrap(), getInstance() and deserialize() must be safe on arbitrary input. Malformed input must be rejected with a RuntimeException: usually a SketchesArgumentException, but standard Java runtime exceptions are also acceptable. Throwing an Error (such as OutOfMemoryError) is not.
  • Java-specific definition of a vulnerability. Java checks array and segment bounds, so the C++ wording (out-of-bounds reads and writes, undefined behavior) doesn't apply. Instead, deserializing must not:
    • loop forever;
    • allocate memory based on declared sizes that are inconsistent with the rest of the input or exceed the sketch type's documented limits;
    • return a sketch that later hangs or exhausts memory. (A sketch that later throws a runtime exception is an ordinary bug, not a vulnerability.)
  • Oversized caller segments are supported. A caller-provided MemorySegment larger than the sketch needs, so a direct sketch can grow in place, is allowed. Bytes beyond the serialized image must not be trusted.
  • Item serializers: an ArrayOfItemsSerDe written by the application is the application's responsibility.
  • Out of scope: misuse of other APIs, and adversarial bias of estimates (same as C++).

Documentation only; no code changes.

🤖 Generated with Claude Code