Adds SECURITY.md to outline our security policies #2086

SaptakS · 2025-05-30T08:38:59Z

As discussed in our last meeting, along with a .well-known/security.txt, it's nice to have a SECURITY.md to be shown as our security policy in the GitHub Security tab.

This PR adds the policies for reporting a bug and disclosing.

for more information, see https://pre-commit.ci

SaptakS · 2025-05-30T08:40:45Z

.github/SECURITY.md

+from a member of the website working group within 3 working days. After that,
+the website working group will begin their analysis. Depending on the action
+to be taken, you may receive followup emails. It can take several weeks before
+the website working group comes to a conclusion and resolve the issue.


I have mostly just copied from Django's security policy. We might want to update.

I'd remove or extend the 3 working days timeline, we don't need to set a timeline on ourselves like for the framework.

SaptakS · 2025-05-30T08:41:41Z

.github/SECURITY.md

+- Confirm the problem.
+- Audit code to find any potential similar problems.
+- Apply the relevant patches to the codebase.
+- Deploy the fixed codebase.


Do we know how we want to disclose a security issue, since for the website, we don't really need to make releases and ask users to update. Maybe this section should be titled differently. Thoughts?

My first thought would be, do we even need a disclosure policy at all?

I doubt we'd need to disclose anything unless user data is compromised.

SaptakS · 2025-05-30T08:42:05Z

.github/SECURITY.md

+to follow few guidelines that helps us in analysis and resolving the issue quicker.
+
+- Include a runnable proof of concept to reproduce the issue
+- User input must be sanitized


Are there other website specific guidelines we want to add?

What does "User input must be sanitized" means in this context?
I'm not sure what it means, so it could also be confusing for a reporter.

+1 - User input must be sanitized is unclear to me too.

adamzap

Looking good so far! I left a few comments with grammatical corrections.

adamzap · 2025-07-03T19:07:20Z

.github/SECURITY.md

+## Reporting a Bug
+
+The Django website working group is committed to responsible reporting and
+disclosure of security-related issue in our website. We appreciate your efforts


"issue in" => "issues on"

adamzap · 2025-07-03T19:08:29Z

.github/SECURITY.md

+from a member of the website working group within 3 working days. After that,
+the website working group will begin their analysis. Depending on the action
+to be taken, you may receive followup emails. It can take several weeks before
+the website working group comes to a conclusion and resolve the issue.


"resolve" => "resolves"

adamzap · 2025-07-03T19:09:41Z

.github/SECURITY.md

+## Reporting Guidelines
+
+While reporting a security issue related to the Django website, we encourage
+to follow few guidelines that helps us in analysis and resolving the issue quicker.


"we encourage to follow few guidelines that helps us" => "we encourage you to follow a few guidelines that help us"

adamzap · 2025-07-03T19:11:40Z

.github/SECURITY.md

+- Confirm the problem.
+- Audit code to find any potential similar problems.
+- Apply the relevant patches to the codebase.
+- Deploy the fixed codebase.


I doubt we'd need to disclose anything unless user data is compromised.

Stormheg

Thank you for starting this @SaptakS

Here are some additional thoughts on content - feel free to incorporate in your own words as this is LLM generated.

- a description of the vulnerability
- steps to reproduce the issue
- any relevant supporting material (e.g., proof-of-concept, screenshots, affected URLs)
- do not publicly disclose the vulnerability until we have confirmed and addressed it
- do not exploit the vulnerability beyond what is necessary to demonstrate it, especially if it permits you access to sensitive or personal data. Respect the privacy of others.

## rewards

We do not offer monetary rewards or bug bounties for vulnerability reports. Please do not request payment for reporting a vulnerability.

## report quality

We welcome well-researched and clearly explained reports.  
Automated or low-effort submissions that do not demonstrate a clear security impact are not appreciated and may be discarded after review.  
We will always send an acknowledgment of receipt, but reports that lack sufficient detail may not be investigated further.

Stormheg · 2025-08-10T12:39:20Z

.github/SECURITY.md

@@ -0,0 +1,46 @@
+# Security Policies and Procedures
+
+This document outlines security procedures and general policies for the Django website (`djangoproject.com`). This is separate from [Django's security policies](https://docs.djangoproject.com/en/dev/internals/security/).


Should we mention this also covers docs.djangoproject.com since this is the same application?

Stormheg · 2025-08-10T12:42:31Z

.github/SECURITY.md

+and responsible disclosure.
+
+Report security bugs and issue by sending an email to website-wg@djangoproject.com.
+For encryption, use: https://keys.openpgp.org/vks/v1/by-fingerprint/AF3516D27D0621171E0CCE25FCB84B8D1D17F80B


@SaptakS this does not look correct to me. This key is for security@djangoproject.com. Our working group does not posses the private key so we would be unable to decrypt messages that were encrypted with this key.

Perhaps GitHub's 'report a vulnerability' feature could be recommended instead as a secure alternative? https://github.com/django/djangoproject.com/security/advisories/new

Stormheg · 2025-08-10T12:44:05Z

.github/SECURITY.md

+to follow few guidelines that helps us in analysis and resolving the issue quicker.
+
+- Include a runnable proof of concept to reproduce the issue
+- User input must be sanitized


+1 - User input must be sanitized is unclear to me too.

Stormheg · 2025-08-10T12:59:14Z

.github/SECURITY.md

+If you have suggestions on how this process could be improved please submit a
+pull request.


Could we make this a direct link to the 'edit file' feature in GitHub? Make it as easy as possible to suggest improvements.

SaptakS and others added 2 commits May 30, 2025 13:57

Adds SECURITY.md to outline our security policies

ba5e9ba

[pre-commit.ci] auto fixes from pre-commit.com hooks

240b758

for more information, see https://pre-commit.ci

SaptakS commented May 30, 2025

View reviewed changes

Stormheg mentioned this pull request Jun 5, 2025

Add .well-known/security.txt file #2062

Open

adamzap suggested changes Jul 3, 2025

View reviewed changes

Stormheg reviewed Aug 10, 2025

View reviewed changes

		@@ -0,0 +1,46 @@
		# Security Policies and Procedures

		This document outlines security procedures and general policies for the Django website (`djangoproject.com`). This is separate from [Django's security policies](https://docs.djangoproject.com/en/dev/internals/security/).

		If you have suggestions on how this process could be improved please submit a
		pull request.

Uh oh!

Adds SECURITY.md to outline our security policies #2086

Are you sure you want to change the base?

Adds SECURITY.md to outline our security policies #2086

Uh oh!

Conversation

SaptakS commented May 30, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

adamzap left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Stormheg left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!