Oh, I Found a Security Issue (reloaded 2026)

My talk from DjangoCon Europe 2026

Transcript

1. Oh, I Found a Security Issue DjangoCon Europe 2026 — Markus Holtermann @markush@chaos.social
2. • Senior Software Engineer at Kraken Tech • Member of the Django Security Team Hi, I’m Markus 👋
3. Date: Tue, 3 Mar 2026 11:15:45 -0300 From: Natalia Bidart <*****@*****> To: django-announce <django-announce@googlegroups.com> Subject: [django-announce] Django security releases issued: 6.0.3, 5.2.12, and 4.2.29 Details are available on the Django project weblog: https://www.djangoproject.com/weblog/2026/mar/03/security-releases/
4. Django’s Security Policy https://docs.djangoproject.com/en/dev /internals/security/ • Reporting security issues
5. Django’s Security Policy https://docs.djangoproject.com/en/dev /internals/security/ • Reporting security issues • How does Django evaluate a report
6. Django’s Security Policy https://docs.djangoproject.com/en/dev /internals/security/ • Reporting security issues • How does Django evaluate a report • Security issue severity levels
7. Django’s Security Policy https://docs.djangoproject.com/en/dev /internals/security/ • Reporting security issues • How does Django evaluate a report • Security issue severity levels • Supported versions
8. Django’s Security Policy https://docs.djangoproject.com/en/dev /internals/security/ • Reporting security issues • How does Django evaluate a report • Security issue severity levels • Supported versions • How Django discloses security issues
9. Report
10. security@djangoproject.com Report
11. security@djangoproject.com Triage Report
12. Release Triage security@djangoproject.com Report
13. Release Triage security@djangoproject.com Report Announcement
14. How to apply this to your project?
15. Setup reporting channel
16. Setup reporting channel Monitor for reports
17. Setup reporting channel Monitor for reports Fix issues
18. Setup reporting channel Monitor for reports Fix issues Release and announce
19. History of Security Issues
20. Number of CVEs per year
21. CVEs per classification
22. Top 4 classifications by year
23. HackerOne Submissions
24. CVE 2025-64459 Potential SQL injection via _connector keyword argument in QuerySet and Q objects
25. HackerOne Submissions
26. HackerOne Submissions
27. What’s next?
28. Thank you Contacts: Markus Holtermann Senior Software Engineer @markush@chaos.social