diff --git a/.github/ISSUE_TEMPLATE/bug.yml b/.github/ISSUE_TEMPLATE/bug.yml new file mode 100644 index 0000000..148bb0d --- /dev/null +++ b/.github/ISSUE_TEMPLATE/bug.yml @@ -0,0 +1,52 @@ +name: Bug report +description: DjangoAPI Guard does not behave as documented +title: "[BUG] " +labels: [bug] +body: + - type: input + id: value + attributes: + label: Value this delivers + description: One sentence a user could witness once this is fixed. + placeholder: "Requests whose JSON body contains a URL are no longer flagged on endpoints that disable suspicious-pattern detection." + validations: + required: true + - type: textarea + id: what + attributes: + label: What happened + description: What you did, what you expected, what you got. Error messages, tracebacks and logs go here. + validations: + required: true + - type: textarea + id: steps + attributes: + label: Steps to reproduce + placeholder: | + 1. Configure DjangoAPI Guard with '...' + 2. Send a request to '...' + 3. See error + validations: + required: true + - type: input + id: versions + attributes: + label: Versions + description: DjangoAPI Guard version, Python version, framework and version, OS. + placeholder: "djapi-guard x.y.z, guard-core 4.4.0, Python 3.13, Django 5.2, Ubuntu 24.04" + validations: + required: true + - type: textarea + id: config + attributes: + label: Configuration + description: Your config with secrets masked. + render: python + placeholder: | + from djangoapi_guard import SecurityConfig + config = SecurityConfig(...) + - type: textarea + id: context + attributes: + label: Additional context + description: Production or development, consistent or intermittent, workarounds tried. diff --git a/.github/ISSUE_TEMPLATE/bug_report.md b/.github/ISSUE_TEMPLATE/bug_report.md deleted file mode 100644 index 6305858..0000000 --- a/.github/ISSUE_TEMPLATE/bug_report.md +++ /dev/null @@ -1,78 +0,0 @@ ---- - -name: Bug report -about: Create a report to help us improve DjangoAPI Guard -title: '[BUG] ' -labels: bug -assignees: '' ---- - -Bug Description -=============== - -A clear and concise description of what the bug is. - -___ - -Steps To Reproduce ------------------- - -Steps to reproduce the behavior: - -1. Configure DjangoAPI Guard with '...' -2. Make request to endpoint '....' -3. See error - -___ - -Expected Behavior ------------------ - -A clear and concise description of what you expected to happen. - -___ - -Actual Behavior ---------------- - -What actually happened, including error messages, stack traces, or logs. - -___ - -Environment ------------ - -- DjangoAPI Guard version: [e.g. 1.0.0] -- Python version: [e.g. 3.11.10] -- Django version: [e.g. 5.1.0] -- OS: [e.g. Ubuntu 22.04, Windows 11, MacOS 15.4] -- Other relevant dependencies: - -___ - -Configuration -------------- - -```python -# Include your DjangoAPI Guard configuration here -# settings.py -MIDDLEWARE = [ - "djangoapi_guard.middleware.DjangoAPIGuard", - # ... -] - -GUARD_SECURITY_CONFIG = { - # Include your config here -} -``` - -___ - -Additional Context ------------------- - -Add any other context about the problem here. For example: - -- Is this happening in production or development? -- Does it happen consistently or intermittently? -- Have you tried any workarounds? diff --git a/.github/ISSUE_TEMPLATE/docs.yml b/.github/ISSUE_TEMPLATE/docs.yml new file mode 100644 index 0000000..5603ef7 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/docs.yml @@ -0,0 +1,31 @@ +name: Documentation +description: Wrong, missing or unclear DjangoAPI Guard documentation +title: "[DOCS] " +labels: [documentation] +body: + - type: input + id: value + attributes: + label: Value this delivers + description: One sentence a reader could witness once this is fixed. + placeholder: "The Redis page shows the exact config for a TLS connection." + validations: + required: true + - type: input + id: page + attributes: + label: Page + description: URL of the page or section. + validations: + required: true + - type: textarea + id: problem + attributes: + label: What is wrong or missing + validations: + required: true + - type: textarea + id: proposal + attributes: + label: Proposed text + render: markdown diff --git a/.github/ISSUE_TEMPLATE/documentation.md b/.github/ISSUE_TEMPLATE/documentation.md deleted file mode 100644 index ee91701..0000000 --- a/.github/ISSUE_TEMPLATE/documentation.md +++ /dev/null @@ -1,53 +0,0 @@ ---- - -name: Documentation -about: Report issues with the DjangoAPI Guard documentation or suggest improvements -title: '[DOCS] ' -labels: documentation -assignees: '' ---- - -Documentation Issue -=================== - -Describe the issue or improvement needed for the documentation. - -___ - -Current Documentation ---------------------- - -Link to the current documentation page or section that needs improvement: -[Link it here](https://example.com) - -___ - -Suggested Changes ------------------ - -Describe what changes you suggest: - -- [ ] Clarify existing content -- [ ] Add missing information -- [ ] Fix incorrect information -- [ ] Improve examples -- [ ] Fix typos/grammar -- [ ] Other (please specify) - -___ - -Proposed Text -------------- - -If you have a specific suggestion for new text, please provide it here: - -```markdown -# Your proposed documentation text here -``` - -___ - -Additional Context ------------------- - -Any other information or screenshots about the documentation issue. diff --git a/.github/ISSUE_TEMPLATE/feature.yml b/.github/ISSUE_TEMPLATE/feature.yml new file mode 100644 index 0000000..d18b0d7 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/feature.yml @@ -0,0 +1,35 @@ +name: Feature request +description: Suggest an improvement to DjangoAPI Guard +title: "[FEATURE] " +labels: [enhancement] +body: + - type: input + id: value + attributes: + label: Value this delivers + description: One sentence a user could witness once this exists. + placeholder: "A single decorator disables all detection for one endpoint." + validations: + required: true + - type: textarea + id: job + attributes: + label: The job you are trying to get done + description: The outcome you need, not the mechanism you imagine. + validations: + required: true + - type: textarea + id: workaround + attributes: + label: How you work around it today + - type: textarea + id: example + attributes: + label: Example usage + description: Pseudocode of how you would like to use it. + render: python + - type: textarea + id: context + attributes: + label: Additional context + description: Similar features in other libraries, constraints, API implications. diff --git a/.github/ISSUE_TEMPLATE/feature_request.md b/.github/ISSUE_TEMPLATE/feature_request.md deleted file mode 100644 index 0a74172..0000000 --- a/.github/ISSUE_TEMPLATE/feature_request.md +++ /dev/null @@ -1,60 +0,0 @@ ---- - -name: Feature request -about: Suggest an idea for DjangoAPI Guard -title: '[FEATURE] ' -labels: enhancement -assignees: '' ---- - -Is your feature request related to a problem -============================================= - -A clear and concise description of what the problem is. Ex. I'm always facing issues when [...] - -___ - -Describe the solution you'd like ---------------------------------- - -A clear and concise description of what you want to happen. Include any API design ideas or examples of how you'd like to use this feature. - -___ - -Describe alternatives you've considered ---------------------------------------- - -A clear and concise description of any alternative solutions or features you've considered. - -___ - -Example Implementation ----------------------- - -If possible, provide a pseudocode example of how this feature might be implemented or used: - -```python -# Example code showing how you'd like to use this feature -# settings.py -MIDDLEWARE = [ - "djangoapi_guard.middleware.DjangoAPIGuard", - # ... -] - -GUARD_SECURITY_CONFIG = { - "new_feature": { - # Your feature configuration here - } -} -``` - -___ - -Additional context ------------------- - -Add any other context or screenshots about the feature request here: - -- How would this benefit the community? -- Are there similar implementations in other libraries that could be referenced? -- Would this require changes to existing APIs? diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md index 626de14..7340ea9 100644 --- a/.github/PULL_REQUEST_TEMPLATE.md +++ b/.github/PULL_REQUEST_TEMPLATE.md @@ -54,7 +54,7 @@ Checklist --------- - + - [ ] My code follows the code style of this project (Mypy, Ruff) - [ ] I have added tests to cover my changes diff --git a/GOVERNANCE.md b/GOVERNANCE.md new file mode 100644 index 0000000..8b5b22c --- /dev/null +++ b/GOVERNANCE.md @@ -0,0 +1,29 @@ +# Governance + +DjangoAPI Guard is part of the [Guard Core](https://github.com/Guard-Core) ecosystem. I maintain it alone; [MAINTAINERS.md](MAINTAINERS.md) lists who I am and how to check it. + +## Decisions + +I make the final call on every change: features, releases, security fixes and repository access. A proposal starts as an issue, so the reasoning is public before any code is written. + +## How a change lands + +1. Every change is a pull request to `master`. +2. The branch ruleset requires signed commits, linear history, passing status checks and two approvals, one of them from a code owner ([CODEOWNERS](CODEOWNERS)). As the only maintainer I cannot get those approvals, so I merge my own pull requests with admin rights. That skips the approval count only: I never merge with a failing check. +3. A pull request closes an open issue (`Closes #N`), or carries the `no-issue` label when it is a small fix with nothing to discuss. + +## Releases + +Versions follow semantic versioning. Adapters version on their own, because each one follows its framework, and declare the engine versions they support. Releases are cut from tags and recorded in [CHANGELOG.md](CHANGELOG.md). + +## Security + +Vulnerabilities go through [SECURITY.md](SECURITY.md), never through public issues. + +## New maintainers + +Contributors with a record of reviewed and merged work can be invited as maintainers. A new maintainer is added to MAINTAINERS.md and CODEOWNERS in a pull request. + +## Conduct + +The [Code of Conduct](CODE_OF_CONDUCT.md) applies to every space of this project. diff --git a/MAINTAINERS.md b/MAINTAINERS.md new file mode 100644 index 0000000..58c42df --- /dev/null +++ b/MAINTAINERS.md @@ -0,0 +1,21 @@ +# Maintainers + +DjangoAPI Guard has one maintainer. + +| Name | GitHub | Email | Role | +|---|---|---|---| +| Renzo Franceschini | [@rennf93](https://github.com/rennf93) | rennf93@guard-core.com | Lead maintainer: reviews and merges every change, publishes every release, handles security reports | + +## Identity + +- GitHub profile [@rennf93](https://github.com/rennf93): name Renzo Franceschini, website guard-core.com. +- [guard-core.com/company](https://guard-core.com/company) names Renzo Franceschini and links to @rennf93. +- The [Guard-Core](https://github.com/Guard-Core) GitHub organization has guard-core.com as a verified domain. +- PyPI: the [djapi-guard](https://pypi.org/project/djapi-guard/) metadata names `Renzo Franceschini `. + +## Related files + +- Code ownership: [CODEOWNERS](CODEOWNERS) +- How decisions are made: [GOVERNANCE.md](GOVERNANCE.md) +- Security reports: [SECURITY.md](SECURITY.md) +- Getting help: [SUPPORT.md](SUPPORT.md) diff --git a/SECURITY.md b/SECURITY.md index ebfaff2..8356a3b 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -2,19 +2,19 @@ ## Supported Versions -We currently provide security updates for the following versions of DjangoAPI Guard: +I provide security updates for the following versions of DjangoAPI Guard: -| Version | Supported | -| ------- | ------------------ | -| 2.0.x | :white_check_mark: | -| 1.x.x | :white_check_mark: | -| < 1.0 | :x: | +| Version | Supported | +| ------- | --------- | +| 5.x | :white_check_mark: bug and security fixes | +| 4.x | :white_check_mark: security fixes only | +| < 4.0 | :x: | ## Reporting a Vulnerability -We take the security of DjangoAPI Guard seriously. If you believe you've found a security vulnerability, please follow these steps: +I take the security of DjangoAPI Guard seriously. If you believe you've found a security vulnerability, please follow these steps: -1. **Do not disclose the vulnerability publicly** until it has been addressed by the maintainers. +1. **Do not disclose the vulnerability publicly** until I have fixed it. 2. **Report the vulnerability through [GitHub's security advisory feature](https://github.com/Guard-Core/djapi-guard/security/advisories/new)**: - Click "New draft security advisory" - Fill in the details of the vulnerability @@ -26,7 +26,7 @@ We take the security of DjangoAPI Guard seriously. If you believe you've found a - Affected versions - Any potential mitigations or workarounds -The maintainers will acknowledge your report within 48 hours and provide a detailed response within 7 days, including the next steps in handling the vulnerability. +I will acknowledge your report within 48 hours and send a detailed response within 7 days, including the next steps in handling the vulnerability. ## Security Best Practices @@ -96,16 +96,16 @@ Note that DjangoAPI Guard is a defense-in-depth measure and should be used along ## Security Updates -Security updates will be released as needed. We recommend subscribing to GitHub releases or regularly checking for updates to ensure you're using the most secure version. +Security updates will be released as needed. I recommend subscribing to GitHub releases or regularly checking for updates to ensure you're using the most secure version. ## Responsible Disclosure -We follow responsible disclosure principles. If you report a vulnerability to us: +I follow responsible disclosure principles. If you report a vulnerability to me: -1. We will confirm receipt of your vulnerability report -2. We will provide an estimated timeline for a fix -3. We will notify you when the vulnerability is fixed -4. We will publicly acknowledge your responsible disclosure (unless you prefer to remain anonymous) +1. I will confirm receipt of your vulnerability report +2. I will provide an estimated timeline for a fix +3. I will notify you when the vulnerability is fixed +4. I will publicly acknowledge your responsible disclosure (unless you prefer to remain anonymous) ## License diff --git a/SUPPORT.md b/SUPPORT.md new file mode 100644 index 0000000..d0aa787 --- /dev/null +++ b/SUPPORT.md @@ -0,0 +1,8 @@ +# Support + +- Documentation: [https://guard-core.github.io/djapi-guard/](https://guard-core.github.io/djapi-guard/) +- Questions: [GitHub Discussions](https://github.com/Guard-Core/djapi-guard/discussions) +- Chat: [Discord](https://discord.gg/ZW7ZJbjMkK), #help for questions, #releases for new versions. +- Bugs and feature requests: [issues](https://github.com/Guard-Core/djapi-guard/issues/new/choose), using the templates. +- Security reports: [SECURITY.md](SECURITY.md), never a public issue. +- The hosted Guard Core app (app.guard-core.com): [saas-issues](https://github.com/Guard-Core/saas-issues).