Changes between Version 4 and Version 5 of SecurityTeam

Timestamp:

Mar 3, 2025, 10:07:21 AM (3 days ago)

Author:

Natalia Bidart

Comment:

Added a few more response templates.

SecurityTeam

@@ -5 +5 @@
 == Canned Responses == 
 
-
 === Report acknowledgement === 
 
-Hi,
+Hello,
 
-Thank you for the report!
+Thank you for your report. We will investigate and get back to you soon. In the meantime, please keep this information confidential.
 
-We will investigate and get back to you soon.
-
-Please keep this private until we complete our analysis.
+If you haven't already, please review how the Django security team evaluates reports: https://docs.djangoproject.com/en/dev/internals/security/.
 
 Note that it can take several weeks before we have completed our analysis. There is no need to chase the security team unless you discover new, relevant information. All reports aim to be resolved within the industry-standard 90 days.
 
-=== Confirmation of vulnerability === 
+Kind regards, the Django Security Team.
+
+=== DMARC/SPF/Email Spoofing ===
+
+Hello,
+
+Thank you for your report. The current DMARC and SPF settings are intentional, and we do not consider this a vulnerability.
+
+For more information on how the Django security team evaluates reports, please see: https://docs.djangoproject.com/en/dev/internals/security/.
+
+Kind regards, the Django Security Team.
+
+=== Report about djangoproject.com ===
+
+Hello,
+
+Thank you for your report. This mailing list is intended for reporting security issues related to the Django web framework, rather than its website. I will forward your concern to our Ops team, but you can consider this issue closed.
+
+For more information on how the Django security team evaluates reports, please see: https://docs.djangoproject.com/en/dev/internals/security/.
+
+Kind regards, the Django Security Team.
+
+=== Asked for support instead ===
+
+Hello,
+
+This mailing list is intended for reporting security issues in the Django web framework, not for support related to using or contributing to Django.
+
+For assistance, please refer to the Getting Help page (https://docs.djangoproject.com/en/dev/faq/help/), where you'll find resources and communities ready to support you. Following these guidelines will also help you structure your question in a way that makes it easier for others to assist.
+
+Thanks for your understanding!
+
+== Confirmation of vulnerability ==
 
 Hello {{ name }},