{{ message }}
doc: add CPython Threat Model and update security policy (#1803) - #1901
Closed
nayanraj864-cmyk wants to merge 3 commits into
Closed
nayanraj864-cmyk wants to merge 3 commits into
nayanraj864-cmyk wants to merge 3 commits into
Conversation
Author
Documentation build overview
|
Member
I'm sorry, but we're not part of GSoC this year. Also some notes on the documents, it largely duplicates existing information (that's in the docs and/or the security policy), so in it's current state I'm afraid it's not particularly helpful. Also, did you use an LLM to generate the page? |
Member
There was a problem hiding this comment.
This is a separate change, not related to the threat model. I also don't see any particular need for it.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR creates an explicit CPython Threat Model document and updates the Security Policy to set clear guidelines for vulnerability reports submitted to the Python Security Response Team (PSRT).
Changes Included:
security/threat-model.rst: Created a new threat model detailing CPython's security boundaries, trusted execution assumptions (command-line flags, environment variables, memory/C-API), non-sandboxing policy (eval,exec,pickle), availability constraints, and standard library module threat models (ssl,urllib,xml,subprocess,tarfile).security/policy.rst: Linked the threat model, added explicit LLM model disclosure requirements for reporters, and emphasized Code of Conduct prioritization.security/index.rst: Registeredthreat-modelin the section Table of Contents.Closes #1803