id	summary	reporter	owner	description	type	status	component	version	severity	resolution	keywords	cc	stage	has_patch	needs_docs	needs_tests	needs_better_patch	easy	ui_ux
20868	Security policy mentions nothing about sending emails to django-announce	Jim Garrison	nobody	"This morning I happened to notice that Jacob posted a security announcement to the Django development blog, and I was surprised I had not received an email about it (like most other such announcements before it).  I re-read the documentation on Django's security policies:

> On the day of disclosure, we will take the following steps:
>
> 1. Apply the relevant patch(es) to Django’s codebase. The commit messages for these patches will indicate that they are for security issues, but will not describe the issue in any detail; instead, they will warn of upcoming disclosure.
> 2. Issue the relevant release(s), by placing new packages on the Python Package Index and on the Django website, and tagging the new release(s) in Django’s git repository.
> 3. Post a public entry on the official Django development blog, describing the issue and its resolution in detail, pointing to the relevant patches and new releases, and crediting the reporter of the issue (if the reporter wishes to be publicly identified).

To my surprise, I realized that emails to django-announce are only //incidentally// triggered if the security issue happens to result in a new release of Django.  But yet I had come to rely on such emails, assuming it was the preferred avenue for learning of Django security announcements.  Despite having read the security policy document several times in my life, I never noticed this fine detail in it.

I think there are two potential solutions here:

* Add a note to the above list, saying all security issues will be sent to django-announce as well; or,
* Add a note above explicitly mentioning that only security issues that trigger a new release will be reported on django-announce

I of course prefer the first option, as it keeps in line with expectations people (including myself) may have developed."	Cleanup/optimization	closed	Documentation	1.5	Normal	fixed			Accepted	0	0	0	0	0	0