id	summary	reporter	owner	description	type	status	component	version	severity	resolution	keywords	cc	stage	has_patch	needs_docs	needs_tests	needs_better_patch	easy	ui_ux
37370	Reorganize Django's security policy page	Sarah Boyce		"Django's security policy has grown organically over time. The page would probably benefit being restructured to make it easier to navigate/read/digest.

The current structure is roughly:

{{{
Django's security policy
├── Reporting security issues
│   ├── Respecting maintainer time
│   └── Reporting guidelines
├── How does Django evaluate a report
├── Supported versions
├── Security issue severity levels
├── How Django discloses security issues
├── Who receives advance notification
└── Requesting notifications
}}}

* Some of the reporting guidelines describe what a reporter should include, while others describe the scope of issues Django will consider.
* Supported versions and severity are also closely related to the assessment process but currently sit separately.
* There are two notification sections which could be grouped

One possible reorganization would be:

{{{
Django's security policy
├── Reporting security vulnerabilities
│   ├── How to report
│   ├── What to include
│   ├── Scope and reporting requirements
│   ├── Respecting maintainer time
│   └── AI-assisted reports
├── Assessing security vulnerabilities
│   ├── How Django evaluates a report
│   ├── Supported versions
│   ├── Security severity levels
│   └── Issues outside Django
├── Disclosing security vulnerabilities
│   ├── Coordinated disclosure
│   ├── Advance disclosure
│   ├── Public disclosure
│   └── Exceptional circumstances
└── Security notifications
    ├── Who receives advance notification
    ├── Who does not receive advance notification
    └── Requesting notifications
}}}

I am open to other grouping/structure suggestions and would welcome us looking at other open source security policies to guide us on what would be best here."	Cleanup/optimization	new	Documentation	6.1	Normal				Accepted	0	0	0	0	0	0