doc_title = "Security" doc_next = "" ^L {% extends doc.html %} {% block doc %}

This page collects security matters that developers should be aware of when creating applications with Aspen. If you have security bugs to disclose, you can use the email and PGP key listed here.

The biggest thing to be aware of when deploying Aspen applications is to be careful of what ends up in your web publishing root. If an attacker is able to write files into your web publishing root, then the attacker can execute arbitrary Python code with the permissions of the user that the Aspen process is running as.

In particular, watch out for: