From de47690813b1d39bd7af0696569891459c65aeb8 Mon Sep 17 00:00:00 2001 From: Stan Ulbrych Date: Sat, 12 Sep 2026 11:24:37 +0100 Subject: [PATCH] Add guidelines for bulk reporting of issues --- security/policy.rst | 2 ++ triage/issue-tracker.rst | 21 +++++++++++++++++++++ 2 files changed, 23 insertions(+) diff --git a/security/policy.rst b/security/policy.rst index 33228e8e8..dd832db2e 100644 --- a/security/policy.rst +++ b/security/policy.rst @@ -1,3 +1,5 @@ +.. _security-policy: + =============== Security policy =============== diff --git a/triage/issue-tracker.rst b/triage/issue-tracker.rst index e55cda18c..2c245b537 100644 --- a/triage/issue-tracker.rst +++ b/triage/issue-tracker.rst @@ -29,6 +29,8 @@ If you would like to file an issue about this devguide, please do so in the :github:`devguide repository ` instead. +.. _checking-if-a-bug-already-exists: + Checking if a bug already exists -------------------------------- @@ -92,6 +94,25 @@ and are covered in the :ref:`triaging` page. You don't need to worry about those when reporting issues as a Python user. +Reporting many issues at once +----------------------------- + +Static analysis, fuzzing, and similar tools can produce a large number of +findings. If you plan to report them in bulk: + +* Run your analysis against the ``main`` branch, so that findings already + fixed in development are excluded. +* Check each finding against existing reports, see + :ref:`checking-if-a-bug-already-exists` for more information. +* Cross-check findings against the :ref:`security-policy` + to make sure it is not a security vulnerability. Vulnerabilities must be + reported privately, not on the issue tracker. +* Rather than opening one issue per finding, open a single issue listing + them all, and link to the full details (reproducers, tracebacks, logs) + as `GitHub gists `_. See :gh:`153852` for an + example. + + Working with issues ===================