Skip to content

Security policy: exceptions are not crashes #1849

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
encukou wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Security policy: exceptions are not crashes #1849

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 4 additions & 2 deletions security/policy.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,8 +45,10 @@ triggerable with data inputs that are reasonably sized for the use case.
Availability vulnerabilities must also demonstrate an "upward" change in posture
for the attacker, rather than a "lateral" one.
This is to avoid handling performance improvements as security vulnerabilities.
Exceptions are an expected part of control flow when processing inputs,
therefore crashes resulting from unhandled exceptions are not security vulnerabilities.

@encukou encukou Jul 1, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@StanFromIreland do you mean keeping it in the previous paragraph?

Suggested change

We can do that, but I think it reads better when it's separate.

@StanFromIreland StanFromIreland Jul 1, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm +1 for keeping it together, it goes naturally with "Vulnerabilities that affect availability" but I'll leave it up to you.

Exceptions are an expected part of control flow when processing inputs.
Unhandled exceptions are not considered crashes and are not, by themselves,
security vulnerabilities.

Vulnerabilities in dependencies of Python (such as zlib, Tcl/Tk, or OpenSSL)
are not vulnerabilities in Python unless Python's use of the dependency
Expand Down
Loading