[airween]

Enrol projects/modsecurity

I have verified each of the following before submitting this project:

• I am a core maintainer of this project.
• I accept the OSS Scanner terms.
• I confirm that I believe my project meets the inclusion criteria and is an established project that users depend on.
• project.yaml follows the README (one project per PR; tools/validate.py passes locally).
• tools/check modsecurity builds the project, and its tests run in the shell that follows.
• primary_contact must be the email address of the primary security contact.
• There is a Dockerfile that builds the project (required) in one of two places: in the project's repository at the path dockerfile: names, or next to project.yaml in this repo.
• threat_model.md is written for this project (recommended but optional), placed in the same way: in the repository at the path threat_model: names, or next to project.yaml in this repo.

Context: OWASP ModSecurity is one of the most widely deployed open-source Web Application Firewalls; it runs inside the web server process (nginx and other servers through connectors) and parses every byte of untrusted HTTP traffic. It is the engine behind the OWASP Core Rule Set in Linux distributions, hosting platforms and nginx-based ingress controllers. primary_contact is the contact address from our security policy. This PR enrols libmodsecurity (v3, branch v3/master); ModSecurity v2 (projects/modsecurity-v2) and the nginx connector (projects/modsecurity-nginx) are separate PRs.

I am the OWASP project leader of ModSecurity, see the project page: https://owasp.org/projects/modsecurity.

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[github-actions]

Enrolment triage: projects/modsecurity

Repository: owasp-modsecurity/ModSecurity at v3/master · opened by airween

	Check	Result
✅	Repository	created 15 years ago, last push today
ℹ️	Stars / forks	9,827 stars · 1,752 forks · 381 watching
ℹ️	Outside participants	29 people from outside the project opened 45 of the last 100 issues and pull requests
ℹ️	Criticality score	0.69 on the OpenSSF scale of 0 to 1 signals created_since 240, updated_since 0, contributor_count 143, org_count 7, commit_frequency 6.1, recent_releases_count 6, closed_issues_count 22, updated_issues_count 101, comment_frequency 6.7, dependents_count 821
ℹ️	Package rank	by downloads: nothing from this repository found in the top 15,000 on PyPI
✅	License	Apache-2.0
✅	Opened by an active maintainer	member of the owning organisation; 100+ commits in the last 12 months; #2 contributor
✅	Contact in SECURITY.md	modsecurity@owasp.org is in SECURITY.md
ℹ️	OSS-Fuzz	not found in OSS-Fuzz
✅	.oss-scanner/ in the repository	present (Dockerfile, threat_model.md); Dockerfile at .oss-scanner/Dockerfile
✅	Pull request scope	only this project's directory
✅	tools/validate.py	passes
✅	Checklist	all 8 ticked

_{Automated, from public data, to help reviewers. Enrolment is decided case by case against the criteria. If you think we got something wrong, please tell us in a reply.}

[airween]

I have read the CLA Document and I hereby sign the CLA