Skip to content

Commit baaa430

Browse files
committed
Addresses comments from wg members related to security advisory
1 parent 6a0f355 commit baaa430

File tree

1 file changed

+18
-30
lines changed

1 file changed

+18
-30
lines changed

.github/SECURITY.md

Lines changed: 18 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -1,46 +1,34 @@
11
# Security Policies and Procedures
22

3-
This document outlines security procedures and general policies for the Django website (`djangoproject.com`). This is separate from [Django's security policies](https://docs.djangoproject.com/en/dev/internals/security/).
3+
This document outlines security procedures and general policies for the Django website (`djangoproject.com`) and Django documentation(`docs.djangoproject.com`). This is separate from [Django's security policies](https://docs.djangoproject.com/en/dev/internals/security/).
44

5-
* [Reporting a Bug](#reporting-a-bug)
6-
* [Reporting Guidelines](#reporting-guidelines)
7-
* [Disclosure Policy](#disclosure-policy)
8-
* [Comments on this Policy](#comments-on-this-policy)
5+
- [Reporting a Bug](#reporting-a-bug)
6+
- [Reporting Guidelines](#reporting-guidelines)
7+
- [Disclosure Policy](#disclosure-policy)
8+
- [Comments on this Policy](#comments-on-this-policy)
99

1010
## Reporting a Bug
1111

1212
The Django website working group is committed to responsible reporting and
13-
disclosure of security-related issue in our website. We appreciate your efforts
13+
disclosure of security-related issue on our website. We appreciate your efforts
1414
and responsible disclosure.
1515

16-
Report security bugs and issue by sending an email to website-wg@djangoproject.com.
17-
For encryption, use: https://keys.openpgp.org/vks/v1/by-fingerprint/AF3516D27D0621171E0CCE25FCB84B8D1D17F80B
16+
Report security bugs and issue by creating a
17+
[new vulnerability report](https://github.com/django/djangoproject.com/security/advisories/new)
18+
in the djangoproject.com repository.
1819

19-
Once you’ve submitted an issue via email, you should receive an acknowledgment
20-
from a member of the website working group within 3 working days. After that,
21-
the website working group will begin their analysis. Depending on the action
22-
to be taken, you may receive followup emails. It can take several weeks before
23-
the website working group comes to a conclusion and resolve the issue.
20+
Once you’ve submitted a security vulnerability report, the website working
21+
group will begin their analysis. Depending on the action to be taken, you may
22+
receive followup emails. It can take several weeks before the website working
23+
group comes to a conclusion and resolves the issue.
2424

2525
## Reporting Guidelines
2626

27-
While reporting a security issue related to the Django website, we encourage
28-
to follow few guidelines that helps us in analysis and resolving the issue quicker.
29-
30-
* Include a runnable proof of concept to reproduce the issue
31-
* User input must be sanitized
32-
33-
## Disclosure Policy
34-
35-
When the website working group receives a security bug report, they will
36-
identify and fix the issues in the website, involving the following steps:
37-
38-
* Confirm the problem.
39-
* Audit code to find any potential similar problems.
40-
* Apply the relevant patches to the codebase.
41-
* Deploy the fixed codebase.
27+
While reporting a security issue related to the Django website, we encourage you
28+
to include a runnable proof of concept to reproduce the issue. That will help us
29+
analyse the issue better.
4230

4331
## Comments on this Policy
4432

45-
If you have suggestions on how this process could be improved please submit a
46-
pull request.
33+
If you have suggestions on how this process could be improved please create a
34+
pull request by [editing this file](https://github.com/django/djangoproject.com/edit/main/.github/SECURITY.md).

0 commit comments

Comments
 (0)