Security report follow-up

[zainnadeem786]

Hi,

I hope you're doing well.

A little while ago, I submitted a security vulnerability report to security@encode.io, but I haven't received an acknowledgement yet.

I completely understand that security reports may take time to review. I just wanted to check whether my email was successfully received and reached the appropriate team.

I'm intentionally not sharing any technical details here, as I'd prefer to keep the report private until it has been reviewed.

Whenever someone has a chance, I'd appreciate a confirmation that the report was received.

Thank you.

[browniebroke]

That email address is unfortunately not reaching any active maintainers at the moment... I know that this is the one mentioned in our security policy, but we need to review this document.

Are you able to report it using this link? https://github.com/encode/django-rest-framework/security/advisories/new

That might be a better route forward, as it provides some tools to help fixing

[zainnadeem786]

Yeah sure I'll submit in few minutes

[zainnadeem786]

@browniebroke it's showing 404

[browniebroke]

I think it had to be enabled via a repo setting... Can you please try again now?

[zainnadeem786]

Yep it's working thanks I'll add the report

[zainnadeem786]

I have created advisory you can check now

[browniebroke]

Got it, will take a look in the coming days (I'm travelling this week-end)