Notice: This page displays a fallback because interactive scripts did not run. Possible causes include disabled JavaScript or failure to load scripts or stylesheets.

≡ Menu
  • Python>>>
  • Report a Security Issue

Python Security

Reporting security issues with PyPI or a project hosted on PyPI

See the security issue information for pypi.org here.

Reporting security issues

The Python Software Foundation and the Python developer community take security vulnerabilities very seriously. A Python Security Response Team (PSRT) has been formed that does triage on all reported vulnerabilities and works to resolve them. To reach the response team, send email to security at python dot org. Only the response team members will see your email, and it will be treated confidentially.

The PSRT mailing list is tightly controlled, so you can have confidence that your security issue will only be read by a highly trusted cabal of Python developers.

The PSRT accepts security reports for the following projects:

The PSRT does not accept reports that only affect pre-release versions of software, as these features are considered "in-development", please open public issues.

The PSRT does not accept reports for third-party redistributions of Python or pip. Those reports should be directed towards their corresponding distribution security contact.

Vulnerability handling

The following is an overview of the vulnerability handling process from reporting to disclosure:

  • The reporter reports the vulnerability privately to the PSRT.
  • If the PSRT determines the report isn't a vulnerability, the issue can be opened in a public issue tracker if applicable.
  • If the report constitutes a vulnerability, the PSRT will work privately with the reporter to resolve the vulnerability.
  • The project creates a new release to deliver the fix.
  • The project publicly announces the vulnerability and describes how to apply the fix via an advisory. At this point the vulnerability can be discussed publicly by the reporter and team.

Bug bounties

While we sincerely appreciate and encourage reports of suspected security problems in supported Python releases and the PSF web infrastructure, please note that the Python Software Foundation does not run any bug bounty programs. We are a nonprofit organization, depending on donation and support from the community.

Published advisories and mailing list

Security advisories are published to multiple public locations. Advisories are sent via email to the security-announce@python.org mailing list. Subscribe to the mailing list if you'd like to be updated on newly published security advisories. The mailing list has a public archive including all historical advisories sent to the list.

There is also an advisory database published to GitHub using the Open Source Vulnerability (OSV) format which can be consumed using automated tooling.

CVE Numbering Authority (CNA) contact

If you need to contact the Python Software Foundation CNA directly, such as for updating or disputing a CVE record, you can send an email to cna at python dot org. Be sure that the CVE record in question was issued by the PSF CNA and not a different CNA.