Summary

Update threat model to include stance on runtime modification

Linked issue

N/A

Changes

N/A

Checklist

• Tests added or updated (or N/A with reason)
• Docs/types updated if public API changed (index.d.ts and index.d.cts)
• No breaking changes (or called out explicitly above)

Summary by cubic

Clarifies the threat model: axios does not defend against monkey‑patched JavaScript/Node.js runtime APIs when attacker code runs in the same process. This sets a clear security boundary.

Description

• Summary of changes: Add a note to THREATMODEL.md stating axios won’t defend against patched runtime APIs like Object.keys, http.request, ClientRequest.prototype.setHeader, or fetch.
• Reasoning: If attacker-controlled code runs in the same process, it can observe or alter requests below axios; this is outside axios’ security boundary.
• Additional context: This does not change existing guidance about guarding config reads against polluted Object.prototype.

Docs

• Mirror this clarification in /docs/security/threat-model.md (or equivalent), and link to it from any security overview page.

Testing

• No tests added. Docs-only change; tests not needed.

Semantic version impact

• No runtime or API changes. No release needed (docs-only).

^{Written for commit 1d206f3. Summary will update on new commits. Review in cubic}