# \#security
**URL:** https://forum.djangoproject.com/tag/security/1.md
[Latest](https://forum.djangoproject.com/latest.md) · [Categories](https://forum.djangoproject.com/categories.md) · [Tags](https://forum.djangoproject.com/tags.md)
---
## [Proposal: Make file upload permissions respect umask](https://forum.djangoproject.com/t/proposal-make-file-upload-permissions-respect-umask/45022)
**Author:** [@shaib](https://forum.djangoproject.com/u/shaib)\
**Replies:** 10\
**Last updated:** [September 29, 2026, 8:50pm UTC](https://forum.djangoproject.com/t/proposal-make-file-upload-permissions-respect-umask/45022 "2026-09-29T20:50:13Z")
Hi all, TL;DR: Today, upload permissions, when set numerically, are applied verbatim to uploaded files and the folders created to hold them. It is suggested to use the process umask to limit these permissions. Details…
---
## [Should we make it harder to cache responses containing CSP nonces?](https://forum.djangoproject.com/t/should-we-make-it-harder-to-cache-responses-containing-csp-nonces/45065)
**Author:** [@jacobtylerwalls](https://forum.djangoproject.com/u/jacobtylerwalls)\
**Replies:** 3\
**Last updated:** [August 15, 2026, 1:36pm UTC](https://forum.djangoproject.com/t/should-we-make-it-harder-to-cache-responses-containing-csp-nonces/45065 "2026-08-15T13:36:29Z")
The CSP nonce attribute on a request is lazy, so we know whether or not it was used. If it was used in a response, should we make it harder to accidentally cache that response? Perhaps by: adding the nonce to the cache…
---
## [Django security releases issued: 6.0.8 and 5.2.17](https://forum.djangoproject.com/t/django-security-releases-issued-6-0-8-and-5-2-17/45672)
**Author:** [@nessita](https://forum.djangoproject.com/u/nessita)\
**Replies:** 0\
**Last updated:** [August 4, 2026, 3:23pm UTC](https://forum.djangoproject.com/t/django-security-releases-issued-6-0-8-and-5-2-17/45672 "2026-08-04T15:23:59Z")
:mega: Announcement: Django security releases issued: 6.0.8 and 5.2.17 | Weblog | Django :tada: Release notes: Django 6.0.8 release notes | Django documentation | Django Django 5.2.17 release notes | Django documentat…
---
## [Django security releases issued: 6.0.7 and 5.2.16](https://forum.djangoproject.com/t/django-security-releases-issued-6-0-7-and-5-2-16/45439)
**Author:** [@jacobtylerwalls](https://forum.djangoproject.com/u/jacobtylerwalls)\
**Replies:** 0\
**Last updated:** [July 7, 2026, 2:06pm UTC](https://forum.djangoproject.com/t/django-security-releases-issued-6-0-7-and-5-2-16/45439 "2026-07-07T14:06:55Z")
:mega: Announcement: Django security releases issued: 6.0.7 and 5.2.16 | Weblog | Django :tada: Release notes: Django 6.0.7 release notes | Django documentation | Django Django 5.2.16 release notes | Django documentat…
---
## [Django security releases issued: 6.0.6 and 5.2.15](https://forum.djangoproject.com/t/django-security-releases-issued-6-0-6-and-5-2-15/45220)
**Author:** [@nessita](https://forum.djangoproject.com/u/nessita)\
**Replies:** 0\
**Last updated:** [June 3, 2026, 1:11pm UTC](https://forum.djangoproject.com/t/django-security-releases-issued-6-0-6-and-5-2-15/45220 "2026-06-03T13:11:44Z")
:mega: Announcement: Django security releases issued: 6.0.6 and 5.2.15 | Weblog | Django :tada: Release notes: Django 6.0.6 release notes | Django documentation | Django Django 5.2.15 release notes | Django documentat…
---
## [Django security releases issued: 6.0.5 and 5.2.14](https://forum.djangoproject.com/t/django-security-releases-issued-6-0-5-and-5-2-14/45059)
**Author:** [@sarahboyce](https://forum.djangoproject.com/u/sarahboyce)\
**Replies:** 0\
**Last updated:** [May 5, 2026, 2:53pm UTC](https://forum.djangoproject.com/t/django-security-releases-issued-6-0-5-and-5-2-14/45059 "2026-05-05T14:53:04Z")
:mega: Announcement: https://www.djangoproject.com/weblog/2026/may/05/security-releases/ :tada: Release notes: Django 6.0.5 release notes | Django documentation | Django Django 5.2.14 release notes | Django documentat…
---
## [Django security releases issued: 6.0.4, 5.2.13, and 4.2.30](https://forum.djangoproject.com/t/django-security-releases-issued-6-0-4-5-2-13-and-4-2-30/44885)
**Author:** [@jacobtylerwalls](https://forum.djangoproject.com/u/jacobtylerwalls)\
**Replies:** 0\
**Last updated:** [April 7, 2026, 2:21pm UTC](https://forum.djangoproject.com/t/django-security-releases-issued-6-0-4-5-2-13-and-4-2-30/44885 "2026-04-07T14:21:35Z")
:mega: Announcement: https://www.djangoproject.com/weblog/2026/apr/07/security-releases/ :tada: Release notes: Django 6.0.4 release notes | Django documentation | Django Django 5.2.13 release notes | Django documentat…
---
## [Django security releases issued: 6.0.3, 5.2.12, and 4.2.29](https://forum.djangoproject.com/t/django-security-releases-issued-6-0-3-5-2-12-and-4-2-29/44366)
**Author:** [@nessita](https://forum.djangoproject.com/u/nessita)\
**Replies:** 0\
**Last updated:** [March 3, 2026, 2:16pm UTC](https://forum.djangoproject.com/t/django-security-releases-issued-6-0-3-5-2-12-and-4-2-29/44366 "2026-03-03T14:16:49Z")
:mega: Announcement: Django security releases issued: 6.0.3, 5.2.12, and 4.2.29 | Weblog | Django :tada: Release notes: Django 6.0.3 release notes | Django documentation | Django Django 5.2.12 release notes | Django d…
---
## [Django security releases issued: 6.0.2, 5.2.11, and 4.2.28](https://forum.djangoproject.com/t/django-security-releases-issued-6-0-2-5-2-11-and-4-2-28/44074)
**Author:** [@jacobtylerwalls](https://forum.djangoproject.com/u/jacobtylerwalls)\
**Replies:** 0\
**Last updated:** [February 3, 2026, 2:17pm UTC](https://forum.djangoproject.com/t/django-security-releases-issued-6-0-2-5-2-11-and-4-2-28/44074 "2026-02-03T14:17:48Z")
:mega: Announcement: Django security releases issued: 6.0.2, 5.2.11, and 4.2.28 | Weblog | Django :tada: Release notes: Django 6.0.2 release notes | Django documentation | Django Django 5.2.11 release notes | Django d…
---
## [Django security releases issued: 5.2.9, 5.1.15, and 4.2.27](https://forum.djangoproject.com/t/django-security-releases-issued-5-2-9-5-1-15-and-4-2-27/43592)
**Author:** [@nessita](https://forum.djangoproject.com/u/nessita)\
**Replies:** 0\
**Last updated:** [December 2, 2025, 2:45pm UTC](https://forum.djangoproject.com/t/django-security-releases-issued-5-2-9-5-1-15-and-4-2-27/43592 "2025-12-02T14:45:00Z")
:mega: Announcement: Django security releases issued: 5.2.9, 5.1.15, and 4.2.27 | Weblog | Django :tada: Release notes: Django 5.2.9 release notes | Django documentation | Django Django 5.1.15 release notes | Django d…
---
## [Django security releases issued: 5.2.8, 5.1.14, and 4.2.26](https://forum.djangoproject.com/t/django-security-releases-issued-5-2-8-5-1-14-and-4-2-26/43373)
**Author:** [@nessita](https://forum.djangoproject.com/u/nessita)\
**Replies:** 0\
**Last updated:** [November 7, 2025, 1:49pm UTC](https://forum.djangoproject.com/t/django-security-releases-issued-5-2-8-5-1-14-and-4-2-26/43373 "2025-11-07T13:49:12Z")
:mega: Announcement: Django security releases issued: 5.2.8, 5.1.14, and 4.2.26 | Weblog | Django :tada: Release notes: Django 5.2.8 release notes | Django documentation | Django Django 5.1.14 release notes | Django d…