Draft VULNERABILITY_REPORT.yml

Author: StanFromIreland

.github/VULNERABILITY_REPORT.yml

@@ -0,0 +1,80 @@
+name: Vulnerability report
+description: Privately report a potential security vulnerability in CPython
+body:
+  - type: markdown
+    attributes:
+      value: |
+        > [!IMPORTANT] Not all bugs are vulnerabilities. Read the [Python security
+        > policy](https://devguide.python.org/security/policy/)
+        > before submitting, and evaluate your report against [what types of
+        > bugs are vulnerabilities](https://devguide.python.org/security/policy/#what-types-of-bugs-are-vulnerabilities)
+        > and [what versions of Python accept reports](https://devguide.python.org/security/policy/#what-versions-of-python-accept-reports).
+
+        Python Security Response Team (*PSRT*) members balance this work against
+        many other responsibilities. Keep the report short and in plain text:
+        no headers, tables, PDFs, binaries, or severity and CVSS information.
+
+        Reports that do not contain a potential security vulnerability will be
+        discarded without a reply.
+
+        This form is for CPython only. For other projects (such as pip or
+        python.org), or if you are not sure where to send your report, email
+        [security@python.org](mailto:security@python.org).
+  - type: textarea
+    id: summary
+    attributes:
+      label: Summary
+      description: A few sentences describing the vulnerability.
+    validations:
+      required: true
+  - type: textarea
+    id: threat_model
+    attributes:
+      label: Threat model
+      description: >
+        What does the attacker control, and what do they gain?
+        Describe the code, configuration, or deployment that may exist in the real world and is exploitable.
+        Where possible, cite the relevant part of the
+        [security policy](https://devguide.python.org/security/policy/#what-types-of-bugs-are-vulnerabilities).
+    validations:
+      required: true
+  - type: textarea
+    id: proof_of_concept
+    attributes:
+      label: Proof of concept
+      description: >
+        A script that reproduces the issue and clearly indicates whether the vulnerability is present,
+        such as exiting with `1` if vulnerable and `0` if not.
+        If it depends on a specially constructed binary file, include a script to construct the file rather than the file itself.
+        Wrap scripts longer than a few lines in a
+        [collapsed section](https://docs.github.com/en/get-started/writing-on-github/working-with-advanced-formatting/organizing-information-with-collapsed-sections)
+        using `<details> ... </details>`.
+    validations:
+      required: true
+  - type: input
+    id: versions
+    attributes:
+      label: Python versions tested
+      description: >
+        List every version tested and indicate which were found to be vulnerable.
+        Only [supported versions](https://devguide.python.org/versions/) accept reports.
+    validations:
+      required: true
+  - type: textarea
+    id: patch
+    attributes:
+      label: Suggested fix
+      description: Ideally, a minimal patch with the mitigation.
+    validations:
+      required: false
+  - type: checkboxes
+    id: checklist
+    attributes:
+      label: Before submitting
+      options:
+        - label: I have read the security policy and evaluated this report against it.
+          required: true
+        - label: I have checked that this issue is not already resolved on the `main` branch.
+          required: true
+        - label: I have verified the factual validity of everything in this report, including any content produced by an LLM.
+          required: true