Skip to content

Adds SECURITY.md to outline our security policies #2086

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Adds SECURITY.md to outline our security policies #2086

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
454f356
Adds SECURITY.md to outline our security policies
SaptakS May 30, 2025
0be5a56
Addresses comments from wg members related to security advisory
SaptakS Oct 2, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
34 changes: 34 additions & 0 deletions .github/SECURITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,34 @@
# Security Policies and Procedures

This document outlines security procedures and general policies for the Django website (`djangoproject.com`) and Django documentation(`docs.djangoproject.com`). This is separate from [Django's security policies](https://docs.djangoproject.com/en/dev/internals/security/).

- [Reporting a Bug](#reporting-a-bug)
- [Reporting Guidelines](#reporting-guidelines)
- [Disclosure Policy](#disclosure-policy)
- [Comments on this Policy](#comments-on-this-policy)

## Reporting a Bug

The Django website working group is committed to responsible reporting and
disclosure of security-related issue on our website. We appreciate your efforts
and responsible disclosure.

Report security bugs and issue by creating a
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
Report security bugs and issue by creating a
Report security bugs and issues by creating a

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is "security bug" a thing? I'm missing what we mean here.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think 'security defect' is a more common term, but did not want to be nitpicky

[new vulnerability report](https://github.com/django/djangoproject.com/security/advisories/new)
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

A downside of this feature is that it requires the reporter to have a GitHub account. Do we consider that acceptable?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Discussed this during the October 2nd meeting, we feel the current form suffices.

We'd rather not handle security reports over unencrypted email since the effort of maintaining the required infrastructure (PGP keys etc) is considered not worth the effort for something that is not even the preferred method of reporting defects.

We'll revisit the issue if this ever posses a problem.

in the djangoproject.com repository.

Once you’ve submitted a security vulnerability report, the website working
group will begin their analysis. Depending on the action to be taken, you may
receive followup emails. It can take several weeks before the website working
group comes to a conclusion and resolves the issue.

## Reporting Guidelines

While reporting a security issue related to the Django website, we encourage you
to include a runnable proof of concept to reproduce the issue. That will help us
analyse the issue better.

## Comments on this Policy

If you have suggestions on how this process could be improved please create a
pull request by [editing this file](https://github.com/django/djangoproject.com/edit/main/.github/SECURITY.md).