Adds SECURITY.md to outline our security policies #2086

SaptakS · 2025-05-30T08:38:59Z

As discussed in our last meeting, along with a .well-known/security.txt, it's nice to have a SECURITY.md to be shown as our security policy in the GitHub Security tab.

This PR adds the policies for reporting a bug and disclosing.

SaptakS · 2025-05-30T08:40:45Z

.github/SECURITY.md

+from a member of the website working group within 3 working days. After that,
+the website working group will begin their analysis. Depending on the action
+to be taken, you may receive followup emails. It can take several weeks before
+the website working group comes to a conclusion and resolve the issue.


I have mostly just copied from Django's security policy. We might want to update.

I'd remove or extend the 3 working days timeline, we don't need to set a timeline on ourselves like for the framework.

SaptakS · 2025-05-30T08:41:41Z

.github/SECURITY.md

+- Confirm the problem.
+- Audit code to find any potential similar problems.
+- Apply the relevant patches to the codebase.
+- Deploy the fixed codebase.


Do we know how we want to disclose a security issue, since for the website, we don't really need to make releases and ask users to update. Maybe this section should be titled differently. Thoughts?

My first thought would be, do we even need a disclosure policy at all?

I doubt we'd need to disclose anything unless user data is compromised.

SaptakS · 2025-05-30T08:42:05Z

.github/SECURITY.md

+to follow few guidelines that helps us in analysis and resolving the issue quicker.
+
+- Include a runnable proof of concept to reproduce the issue
+- User input must be sanitized


Are there other website specific guidelines we want to add?

What does "User input must be sanitized" means in this context?
I'm not sure what it means, so it could also be confusing for a reporter.

+1 - User input must be sanitized is unclear to me too.

adamzap

Looking good so far! I left a few comments with grammatical corrections.

adamzap · 2025-07-03T19:07:20Z

.github/SECURITY.md

+## Reporting a Bug
+
+The Django website working group is committed to responsible reporting and
+disclosure of security-related issue in our website. We appreciate your efforts


"issue in" => "issues on"

adamzap · 2025-07-03T19:08:29Z

.github/SECURITY.md

+from a member of the website working group within 3 working days. After that,
+the website working group will begin their analysis. Depending on the action
+to be taken, you may receive followup emails. It can take several weeks before
+the website working group comes to a conclusion and resolve the issue.


"resolve" => "resolves"

adamzap · 2025-07-03T19:09:41Z

.github/SECURITY.md

+## Reporting Guidelines
+
+While reporting a security issue related to the Django website, we encourage
+to follow few guidelines that helps us in analysis and resolving the issue quicker.


"we encourage to follow few guidelines that helps us" => "we encourage you to follow a few guidelines that help us"

adamzap · 2025-07-03T19:11:40Z

.github/SECURITY.md

+- Confirm the problem.
+- Audit code to find any potential similar problems.
+- Apply the relevant patches to the codebase.
+- Deploy the fixed codebase.


I doubt we'd need to disclose anything unless user data is compromised.

Stormheg

Thank you for starting this @SaptakS

Here are some additional thoughts on content - feel free to incorporate in your own words as this is LLM generated.

- a description of the vulnerability
- steps to reproduce the issue
- any relevant supporting material (e.g., proof-of-concept, screenshots, affected URLs)
- do not publicly disclose the vulnerability until we have confirmed and addressed it
- do not exploit the vulnerability beyond what is necessary to demonstrate it, especially if it permits you access to sensitive or personal data. Respect the privacy of others.

## rewards

We do not offer monetary rewards or bug bounties for vulnerability reports. Please do not request payment for reporting a vulnerability.

## report quality

We welcome well-researched and clearly explained reports.  
Automated or low-effort submissions that do not demonstrate a clear security impact are not appreciated and may be discarded after review.  
We will always send an acknowledgment of receipt, but reports that lack sufficient detail may not be investigated further.

Stormheg · 2025-08-10T12:39:20Z

.github/SECURITY.md

@@ -0,0 +1,46 @@
+# Security Policies and Procedures
+
+This document outlines security procedures and general policies for the Django website (`djangoproject.com`). This is separate from [Django's security policies](https://docs.djangoproject.com/en/dev/internals/security/).


Should we mention this also covers docs.djangoproject.com since this is the same application?

Stormheg · 2025-08-10T12:42:31Z

.github/SECURITY.md

+and responsible disclosure.
+
+Report security bugs and issue by sending an email to website-wg@djangoproject.com.
+For encryption, use: https://keys.openpgp.org/vks/v1/by-fingerprint/AF3516D27D0621171E0CCE25FCB84B8D1D17F80B


@SaptakS this does not look correct to me. This key is for security@djangoproject.com. Our working group does not posses the private key so we would be unable to decrypt messages that were encrypted with this key.

Perhaps GitHub's 'report a vulnerability' feature could be recommended instead as a secure alternative? https://github.com/django/djangoproject.com/security/advisories/new

Stormheg · 2025-08-10T12:44:05Z

.github/SECURITY.md

+to follow few guidelines that helps us in analysis and resolving the issue quicker.
+
+- Include a runnable proof of concept to reproduce the issue
+- User input must be sanitized


+1 - User input must be sanitized is unclear to me too.

Stormheg · 2025-08-10T12:59:14Z

.github/SECURITY.md

+If you have suggestions on how this process could be improved please submit a
+pull request.


Could we make this a direct link to the 'edit file' feature in GitHub? Make it as easy as possible to suggest improvements.

SaptakS · 2025-10-02T12:42:27Z

@adamzap @alexgmin @Stormheg thanks for the comments. I have addressed all the comments. Please take a look again and let me know if looks good.

Stormheg

I'm happy with the state of this. Thank you Saptak.

Stormheg · 2025-10-02T13:20:36Z

.github/SECURITY.md

+disclosure of security-related issue on our website. We appreciate your efforts
+and responsible disclosure.
+
+Report security bugs and issue by creating a


Suggested change

Report security bugs and issue by creating a

Report security bugs and issues by creating a

Is "security bug" a thing? I'm missing what we mean here.

I think 'security defect' is a more common term, but did not want to be nitpicky

Stormheg · 2025-10-02T13:22:26Z

.github/SECURITY.md

+and responsible disclosure.
+
+Report security bugs and issue by creating a
+[new vulnerability report](https://github.com/django/djangoproject.com/security/advisories/new)


A downside of this feature is that it requires the reporter to have a GitHub account. Do we consider that acceptable?

Discussed this during the October 2nd meeting, we feel the current form suffices.

We'd rather not handle security reports over unencrypted email since the effort of maintaining the required infrastructure (PGP keys etc) is considered not worth the effort for something that is not even the preferred method of reporting defects.

We'll revisit the issue if this ever posses a problem.

SaptakS commented May 30, 2025

View reviewed changes

Stormheg mentioned this pull request Jun 5, 2025

Add .well-known/security.txt file #2062

Open

adamzap suggested changes Jul 3, 2025

View reviewed changes

Stormheg reviewed Aug 10, 2025

View reviewed changes

Adds SECURITY.md to outline our security policies

454f356

SaptakS force-pushed the add-security-policy branch from 240b758 to db59f49 Compare October 2, 2025 12:41

SaptakS marked this pull request as ready for review October 2, 2025 12:42

SaptakS force-pushed the add-security-policy branch from 08a2cb6 to e96da94 Compare October 2, 2025 12:45

Addresses comments from wg members related to security advisory

0be5a56

SaptakS force-pushed the add-security-policy branch from 6e9a880 to 0be5a56 Compare October 2, 2025 12:58

Stormheg approved these changes Oct 2, 2025

View reviewed changes

		@@ -0,0 +1,46 @@
		# Security Policies and Procedures

		This document outlines security procedures and general policies for the Django website (`djangoproject.com`). This is separate from [Django's security policies](https://docs.djangoproject.com/en/dev/internals/security/).

		If you have suggestions on how this process could be improved please submit a
		pull request.

	Report security bugs and issue by creating a
	Report security bugs and issues by creating a

Uh oh!

Adds SECURITY.md to outline our security policies #2086

Are you sure you want to change the base?

Adds SECURITY.md to outline our security policies #2086

Uh oh!

Conversation

SaptakS commented May 30, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

adamzap left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Stormheg left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

SaptakS commented Oct 2, 2025

Uh oh!

Stormheg left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants