diff options
| author | nessita <124304+nessita@users.noreply.github.com> | 2025-02-04 08:54:01 -0300 |
|---|---|---|
| committer | Natalia <124304+nessita@users.noreply.github.com> | 2025-02-04 08:56:06 -0300 |
| commit | b814f4ccaa5e228d164fbab8d3dbebbaac617b85 (patch) | |
| tree | 8a563e29ff4c0e7c1a97db63467aa281536b1be8 | |
| parent | 328d54f0b164fccbbecd67111040f6ef55760900 (diff) | |
[5.1.x] Refs #35612 -- Extended docs on how the security team evaluates reports.
Co-authored-by: Shai Berger <shai@platonix.com>
Backport of f609a2da868b2320ecdc0551df3cca360d5b5bc3 from main.
| -rw-r--r-- | docs/internals/security.txt | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/docs/internals/security.txt b/docs/internals/security.txt index 6aac9a6b66..4c3aca61e0 100644 --- a/docs/internals/security.txt +++ b/docs/internals/security.txt @@ -49,8 +49,14 @@ requires a security release: * The vulnerability is within a :ref:`supported version <security-support>` of Django. -* The vulnerability applies to a production-grade Django application. This means - the following do not require a security release: +* The vulnerability does not depend on manual actions that rely on code + external to Django. This includes actions performed by a project's developer + or maintainer using developer tools or the Django CLI. For example, attacks + that require running management commands with uncommon or insecure options + do not qualify. + +* The vulnerability applies to a production-grade Django application. This + means the following scenarios do not require a security release: * Exploits that only affect local development, for example when using :djadmin:`runserver`. |