Add note on unexpected exceptions to security policy by StanFromIreland · Pull Request #1825 · python/devguide

StanFromIreland

Conversation

CC @python/psrt

This is something we've gotten quite a few times, e.g. GHSA-2frx-2h99-jv56 or GHSA-32pj-fh79-3c9p. It's only a security issue if the unexpected exception is attacker-triggerable and causes actual availability harm (not merely an unhandled Python exception).

StanFromIreland changed the title ~~Add note on unexpected exceptions to secuirty policy~~ Add note on unexpected exceptions to security policy

Jun 11, 2026

Co-authored-by: Seth Larson <seth@python.org>

		vulnerabilities.
		This is to avoid handling performance improvements as security vulnerabilities.
		Exceptions are an expected part of control flow when processing inputs,
		therefore crashes resulting from unhandled exceptions are not security vulnerabilities.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We usually use the term “crash” for segfaults rather than exceptions (see Lib/test/crashers for example). Should this be just:

	therefore crashes resulting from unhandled exceptions are not security vulnerabilities.
	therefore unhandled exceptions are not security vulnerabilities.