[devin-ai-integration]

Summary

Adds SECURITY_MODEL.md with the threat model from the security scan on this repo, E2B, desktop and customer-starter-templates. Future security scans read it to prioritize findings.

It covers the code-interpreter-template and ci-release components: the server on 0.0.0.0:49999 with no X-Access-Token check and CORS open to every origin, Jupyter with an empty token, and env vars and cwd placed into kernel code. It also records the accepted risk: in-sandbox services without auth are by design, but reaching them from the internet without the owner's tokens stays in scope. The open question is the server-side allowPublicTraffic default, which decides how serious the port-49999 exposure is.

The other three repos get the same model from their own point of view, and the files link to each other.

Link to Devin session: https://app.devin.ai/sessions/7c40d0473c304cbb99256ec8128f2e08
Open in Devin Desktop: https://app.devin.ai/desktop/session/7c40d0473c304cbb99256ec8128f2e08?variant=devin
Requested by: @mishushakov

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring