Announce Arrow security model

[pitrou]

1. Add a blog post announcing the recently published security model document
2. Reword security page to more explicitly outline the procedure, pointing to the security model as required reading before reporting a potential vulnerability

[github-actions]

Preview URL: https://pitrou.github.io/arrow-site

If the preview URL doesn't work, you may forget to configure your fork repository for preview.
See https://github.com/apache/arrow-site/blob/main/README.md#forks how to configure.

[pitrou]

@alamb @amoeba @paleolimbot Thoughts about this?

[pitrou]

Also cc @raboof

[amoeba]

Looks good. I had a few editorial comments.

[alamb]

Thanks @pitrou -- I have some minor wording suggestions, but none of them are required in my mind. This is a very nice addition

Thank you for all your work in this area

[alamb]

Is the rationale for this to be marked with security related to the fact that this release was only a security fix?

This release contains a single security fix for PyArrow. Other implementations

[pitrou]

Sorry for not answering earlier. Yes, that is the rationale. I don't know if that is a good idea as we have not been announcing security fixes consistently on the blog.

[pitrou]

Anyway, we can remove this keyword later so it should probably not block this PR.

[alamb]

I agree -- if it turns out to be a problem we can remove the keyword

[alamb]

It might make sense here to explicitly list untrusted sources as I think that is the core potential attack vector that has been highlighted several times

Something like

Suggested change

	and understand its implications, as some apparent security issues can actually
	and understand its implications for untrusted data sources, as some apparent security issues can actually

[pitrou]

Thanks for the suggestion, that seems like a good idea.

[alamb]

Upon reflection, I am not sure what we have written is really a security "model" , in that it doesn't seem to be a formal scheme for applying security policies. I would say what we have written is more like "Security Best Practices" or a Trust Model (aka what should be trusted)

perhaps @raboof could help us here with the correct terminology for this concept (maybe it is Security Model)

Also, perhaps we should emphasize we are not (really) introducing a new model, instead in my mind we have instead formalized what was previously implicit. Perhaps a title such as

"Introducing Security Best Practices for Apache Arrow"

Would emphasize this better

[amoeba]

What we have here is more like how the ASF defines it rather than what Wikipedia makes it sound like. I don't have any issues with the current language but also have no experience in this field.

[alamb]

Thanks -- that is a good reference. I agree per the ASF definition we have defined a security model and thus the current PR content / title is good

[paleolimbot]

I took a read through and the text is great. Thank you for working on this!

[alamb]

Thanks again for getting this published @pitrou

[alamb]

The blog is live here in case anyone is looking for it: https://arrow.apache.org/blog/2026/02/09/arrow-security-model/