Oh, I Found a Security Issue
summary
Explains Django’s end-to-end security workflow: report to security@djangoproject.com, private triage and reviewer validation, backported patches across four supported branches, pre-notification to downstream vendors, then a 7-day embargo before public release with CVE assignment. Gives concrete numbers — 62 security reports since 2006, 29 DoS — and specific bugs: URLField verify_exists, billion‑laughs XML entity attack, XSS, CSRF, host‑header/allowed_hosts fixes, rare pickle RCE, directory traversal and info leak fixes, plus HackerOne/Google bounty paths.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 1:30Security Policy
- 2:30Security Process
- 3:22Email Security
- 4:17Assess
- 5:30Fix
- 7:00Validate
- 11:20Release
- 12:15Vulnerability Exposure Number
- 13:15Bounty
- 15:00Django
- 19:25Denial of Service
- 24:20Information Leakage
related talks
26mMaking Django Really, Really, Ridiculously Secure (CW)
29mSecuring Django Applications
48mPractical Django Secuirty
38mFinding Security Issues in Open Source
25m"Security considerations in Python Packaging"
54mPython Security Best Practices Against Vulnerabilities
37mThe Evolution of Rails Security
36mSecurity is hard, but we can't go shopping