Emphasise user responsibility within "Reporting security issues" to detail invalid reports

[Sarah Boyce]

When reporting a potential security vulnerability, the user's code must follow security best practices. A user has a responsibility to follow best practices and Django does not mitigate against when a user has introduced a vulnerability themselves (a common example being forgetting to sanitize user input). That an AI tool¹ can generating insecure code doesn't change this user responsibility.

Having this explicitly documented aims to help improve the quality of reports and/or reduce the amount of time to reply to invalid reports which follow this pattern.

Maybe a note in ​reporting security issues that highlights which also links to the ​security topic is an idea.

---

1. For context, there was an occasion where a reporter suggested a report is valid because "even ChatGPT" has generated insecure code

[Natalia Bidart]

Accepting based on previous conversations within the Security Team.