summaryrefslogtreecommitdiff
path: root/docs/internals/security.txt
AgeCommit message (Collapse)Author
2026-04-02Added section for respecting maintainer time to the security policy.Natalia
This follows a post from Seth Larson (Security Developer-in-Residence at the PSF): https://sethmlarson.dev/respecting-maintainer-time-should-be-in-security-policies
2026-04-02Fixed #36862 -- Doc'd the need for a proxy when deploying ↵Jacob Walls
RemoteUserMiddleware under ASGI. We have a flood of nuisance security reports describing ASGI deployments using RemoteUserMiddleware without a fronting proxy, which is not realistic.
2026-02-26Adjusted default DoS severity level in Security Policy.Natalia
2026-01-29Fixed docs spelling errors accumulated over time.Natalia
The `docs` GitHub action does not install `aspell` so the seplling checks are always passing in CI. After installing it, the following errors are reported: WARNING: internals/security.txt:50: : Spell check: runnable: Include a runnable proof of concept. WARNING: ref/contrib/postgres/search.txt:292: : Spell check: lexeme: an untrusted source. The content of each lexeme is escaped so that any. WARNING: ref/contrib/postgres/search.txt:295: : Spell check: lexemes: You can combine lexemes with other lexemes using the . WARNING: ref/contrib/postgres/search.txt:295: : Spell check: lexemes: You can combine lexemes with other lexemes using the . WARNING: ref/contrib/postgres/search.txt:314: : Spell check: Lexeme: Lexeme objects also support term weighting and prefixes:. WARNING: ref/models/database-functions.txt:1897: : Spell check: ai: 23ai/26ai (23.9) or later.. WARNING: ref/models/database-functions.txt:1897: : Spell check: ai: 23ai/26ai (23.9) or later.. WARNING: ref/models/expressions.txt:439: : Spell check: positionally: can be supplied positionally or only by keyword. For. WARNING: ref/models/fields.txt:1339: : Spell check: ai: PostgreSQL < 18 only supports persisted columns. Oracle < 23ai/26ai (23.7). WARNING: ref/models/fields.txt:1339: : Spell check: ai: PostgreSQL < 18 only supports persisted columns. Oracle < 23ai/26ai (23.7). WARNING: ref/models/fields.txt:1344: : Spell check: ai: s was added on Oracle 23ai/26ai. WARNING: ref/models/fields.txt:1344: : Spell check: ai: s was added on Oracle 23ai/26ai. WARNING: releases/4.2.21.txt:24: : Spell check: unclosed: exception if it encounters an unusually large number of unclosed opening tags.. WARNING: releases/5.1.9.txt:24: : Spell check: unclosed: exception if it encounters an unusually large number of unclosed opening tags.. WARNING: releases/5.2.1.txt:24: : Spell check: unclosed: exception if it encounters an unusually large number of unclosed opening tags.. WARNING: releases/6.1.txt:244: : Spell check: mistyped: suggestions for mistyped subcommand names and argument choices.. WARNING: releases/6.1.txt:281: : Spell check: ai: Oracle 23ai/26ai (23.7+).. WARNING: releases/6.1.txt:281: : Spell check: ai: Oracle 23ai/26ai (23.7+).. WARNING: releases/6.1.txt:343: : Spell check: durations: durations expressed in weeks (. WARNING: Found 19 misspelled words build finished with problems, 20 warnings (with warnings treated as errors). This branch adds some of the words to the allowlist, but for others I chose to rephrase the text in a more approachable manner.
2025-12-08Fixed #36778 -- Extended advice to sanitize input before using in query ↵Jacob Walls
expressions. Thanks Clifford Gama and Simon Charette for reviews.
2025-08-25Refs #36485 -- Rewrapped docs to 79 columns line length.David Smith
Lines in the docs files were manually adjusted to conform to the 79 columns limit per line (plus newline), improving readability and consistency across the content.
2025-06-18Clarified that only latest dependency versions are valid for security reports.Jake Howard
2025-06-17Added guidance on AI-assisted security reports to docs/internals/security.txt.nessita
Co-authored-by: Shai Berger <shai@platonix.com> Co-authored-by: Mike Edmunds <medmunds@gmail.com>
2025-02-24Added security guideline on reasonable size limitations when rendering ↵Sarah Boyce
content via the DTL. This also removes the need to add warnings for every Django template filter.
2025-02-24Added security reporting guidelines.Sarah Boyce
2025-02-24Updated expectations for when security reports will receive a reply.Sarah Boyce
2025-02-04Refs #35612 -- Extended docs on how the security team evaluates reports.nessita
Co-authored-by: Shai Berger <shai@platonix.com>
2024-10-11Fixed #35612 -- Added documentation on how the security team evaluates reports.Sarah Boyce
Co-authored-by: Joshua Olatunji <joshua+github@etentlabs.com>
2024-02-05Changed severity levels to list in security policy docs.shivaramkumar
2023-04-17Used extlinks for PyPI links.Tim Graham
Co-authored-by: Mariusz Felisiak <felisiak.mariusz@gmail.com>
2021-03-09Updated Git branch "master" to "main".Markus Holtermann
This change follows a long discussion on django-develops: https://groups.google.com/g/django-developers/c/tctDuKUGosc/
2020-05-21Added notes related to security pre-notification list requests.Michael Manfre
2019-09-06Fixed #30573 -- Rephrased documentation to avoid words that minimise the ↵Tobias Kunze
involved difficulty. This patch does not remove all occurrences of the words in question. Rather, I went through all of the occurrences of the words listed below, and judged if they a) suggested the reader had some kind of knowledge/experience, and b) if they added anything of value (including tone of voice, etc). I left most of the words alone. I looked at the following words: - simply/simple - easy/easier/easiest - obvious - just - merely - straightforward - ridiculous Thanks to Carlton Gibson for guidance on how to approach this issue, and to Tim Bell for providing the idea. But the enormous lion's share of thanks go to Adam Johnson for his patient and helpful review.
2018-11-15Used auto-numbered lists in documentation.François Freitag
2018-04-17Fixed #29334 -- Updated pypi.python.org URLs to pypi.org.Brett Cannon
2018-03-12Added "Denial-of-service attacks" to the security issue severity classification.Tim Graham
2017-03-13Typo fix.Florian Apolloner
2017-02-15Removed docs/internals/roles.txt.Tim Graham
It's moved to https://www.djangoproject.com/foundation/teams/.
2016-10-15Updated security policy according to current practices.Tim Graham
Also added security release date notifications to django-announce.
2016-01-22Fixed #26020 -- Normalized header stylings in docs.Elif T. Kus
2015-06-25Updated release process for new release schedule.Tim Graham
2015-05-25Added oss-security@lists.openwall.com to security release announcements.Tim Graham
2015-05-21Removed obsolete distros@vs.openwall.org security notification.Tim Graham
2014-08-01Adjusted 'internals' docs to the new organization.Aymeric Augustin
Most of these changes are about using the correct vocabulary -- "core team member" vs "core developer/committer" and adding internal links.
2014-07-27Correctly remove extraneous text about keys from previous edit.James Bennett
2014-07-27Update from key ID in security.txt to authorized release keys list.James Bennett
2014-02-28Fixed doc typos.Tim Graham
2014-01-24Fixed #21824 -- Added reference to LTS in docs/internals/security.txtJames Turley
2013-12-08Updated a bunch of hyperlinks in documentationClaude Paroz
2013-10-04Fixed #21213 -- Added docs for Django's mailing lists.Unai Zalakain
Added docs/internals/mailing-lists.txt documenting the use of django's mailing lists. All references across docs changed to point to this page. The referencing makes use of substitution because there's no way to make a :ref: link in a non-inline fashion in Sphinx. It also makes use of rst_epilog Sphinx conf for making this substitutions across all the docs.
2013-09-19Corrected markup problems in new security summary page.Russell Keith-Magee
2013-09-18Fix #21121: Add archive of security issues.James Bennett
2013-08-09Fixed #20868 -- Added an email to django-announce as a security step.Tim Graham
Thanks garrison for the report.
2013-07-16Rephrased the docs for reporting security issues to make it less intimidating.Loic Bistuer
2012-08-07Add new security-policy documentation.James Bennett
This formally describes our policies on reporting, notification and disclosure of security issues, and provides a detailed explanation of our full security-response process, for reference purposes.
generated by cgit v1.3 (git 2.53.0) at 2026-06-30 21:38:11 +0000