Security

Security

¶

Security policy

What types of bugs are vulnerabilities?

What versions of Python accept reports?

What to include and how to structure a vulnerability report?

How to submit a vulnerability report?

When are security fixes released or backported?

Code of conduct

CVE Numbering Authority (CNA)

Python Security Response Team (PSRT)

Members

How can I join the PSRT?

Responsibilities of PSRT members

Responsibilities of PSRT admins

Triaging a vulnerability report

New report in GitHub Security Advisories (GHSA)

Determining whether a report is a vulnerability

Remediating a vulnerability report

Severity scoring

Developing a patch privately

Publishing an advisory

The PSRT bot

Handling code signing certificate reports

Template responses

Submit using GitHub Security Advisories

Rejecting a vulnerability report

Rejecting a duplicate report

Advisory email

Members emeritus

Software Bill-of-Materials (SBOM)

Updating a dependency

Adding a new dependency

Removing a dependency