Join the Python Security Response Team!

"Thanks to the work of the Security Developer-in-Residence Seth Larson, the Python Security Response Team (PSRT) now has an approved public governance document (PEP 811). Following the new governance structure the PSRT now publishes a public list of members, has documented responsibilities for members and admins, and a defined process for onboarding and offboarding members to balance the needs of security and sustainability. The document also clarifies the relationship between the Python Steering Council and the PSRT."

"And this new onboarding process is already working! The PSF Infrastructure Engineer, Jacob Coffee, has just joined the PSRT as the first new non-"Release Manager" member since Seth joined the PSRT in 2023. We expect new members to join further bolstering the sustainability of security work for the Python programming language. Thanks to Alpha-Omega for their support of Python ecosystem security by sponsoring Seth's work as the Security Developer-in-Residence at the Python Software Foundation."

"Security doesn't happen by accident: it's thanks to the work of volunteers and paid Python Software Foundation staff on the Python Security Response Team to triage and coordinate vulnerability reports and remediations keeping all Python users safe. Just last year the PSRT published 16 vulnerability advisories for CPython and pip, the most in a single year to date! And the PSRT usually can't do this work alone, PSRT coordinators are encouraged to involve maintainers and experts on the projects and submodules. By involving the experts directly in the remediation process ensures fixes adhere to existing API conventions and threat-models, are maintainable long-term, and have minimal impact on existing use-cases."

PEP 811 establishes public governance for the Python Security Response Team, including a published member list, documented responsibilities for members and admins, and defined onboarding and offboarding processes to balance security and sustainability. The new onboarding process enabled the PSF Infrastructure Engineer, Jacob Coffee, to join the PSRT as the first non-Release Manager member under the updated structure. Alpha-Omega provided sponsorship for the Security Developer-in-Residence role that supported this work. The PSRT triages and coordinates vulnerability reports and remediations with volunteers and paid staff, publishing a record 16 vulnerability advisories for CPython and pip last year. The PSRT engages project maintainers and other open source projects to ensure fixes follow API conventions, align with threat models, remain maintainable, and minimize impact on existing use-cases.

Read at Python Software Foundation Blog