Security Team

This page is used by the security team to help with process of analyzing and replying to security reports.

Canned Responses

Report acknowledgement

Hello,

Thank you for your report. We will investigate and get back to you soon. In the meantime, please keep this information confidential.

If you haven't already, please review how the Django security team evaluates reports: ​https://docs.djangoproject.com/en/dev/internals/security/.

Note that it can take several weeks before we have completed our analysis. There is no need to chase the security team unless you discover new, relevant information. All reports aim to be resolved within the industry-standard 90 days.

Kind regards, the Django Security Team.

DMARC/SPF/Email Spoofing

Hello,

Thank you for your report. The current DMARC and SPF settings are intentional, and we do not consider this a vulnerability.

For more information on how the Django security team evaluates reports, please see: ​https://docs.djangoproject.com/en/dev/internals/security/.

Kind regards, the Django Security Team.

Report about djangoproject.com

Hello,

Thank you for your report. This mailing list is intended for reporting security issues related to the Django web framework, rather than its website, so you can consider this issue closed.

For more information on how the Django security team evaluates reports, please see: ​https://docs.djangoproject.com/en/dev/internals/security/.

Kind regards, the Django Security Team.

Asked for support instead

Hello,

This mailing list is intended for reporting security issues in the Django web framework, not for support related to using or contributing to Django.

For assistance, please refer to the Getting Help page (​https://docs.djangoproject.com/en/dev/faq/help/), where you'll find resources and communities ready to support you. Following these guidelines will also help you structure your question in a way that makes it easier for others to assist.

Thanks for your understanding!

Security issue in the development server (runserver)

After review, we've determined that the reported issue only affects the development server used by runserver. As documented at [0]:

"This lightweight development server has not gone through security audits or performance tests, hence is unsuitable for production. Making this server able to handle a production environment is outside the scope of Django."

Also, our security policy at [1] states that:

"[...] This means the following scenarios do not require a security release: Exploits that only affect local development, for example when using runserver."

Because of this, the behavior you reported is not considered a security issue within the Django project. That said, we appreciate your diligence and have opened a public ticket to track a regular fix for this case, with appropriate credit for your report.

Thanks for taking the time to submit it through the appropriate channel.

[0] ​https://docs.djangoproject.com/en/stable/ref/django-admin/#django-admin-runserver

[1] ​https://docs.djangoproject.com/en/stable/internals/security/#how-does-django-evaluate-a-report

Unauthenticated cache purge

(This is a known behavior and we've previously disregarded such reports, needs a skeleton response.)

Bug Bounty program scope

Hello,

Thank you for your email. Django has a bug bounty program, its details can be read here: ​https://hackerone.com/django, but please note that the bounty only applies to security issues found in the Django web framework, rather than to the djangoproject.com or any other website built with Django.

Kind regards, the Django Security Team.

Confirmation of vulnerability

Hello {{ name }},

Thank you for your report and patience. We have confirmed the vulnerability, which has been assigned {{ cve_number }}.

I have attached our proposed mitigation solution. Could you please test the patch to ensure it reliably fixes the issue?

We plan to mention the discoverer of the vulnerability in a blog post. Is "{{ name }}" okay, or would you prefer to be credited differently?

The Django release with this fix is currently planned for {{ planned_release_date }}. Please keep this private until after the updated versions are published.

Thank you again!