Everything You Need to Know About Joining the Python Security Response Team
The Python Security Response Team (PSRT) serves as the frontline defense for the Python ecosystem, handling vulnerability reports and coordinating fixes. Thanks to Security Developer-in-Residence Seth Larson, the team recently adopted a new governance model (PEP 811), making membership transparent and sustainable. This article answers key questions about the PSRT and how you can become part of this critical effort.
What Is the Python Security Response Team and Why Does It Matter?
The PSRT is a volunteer-led group, supported by PSF staff, that triages and coordinates vulnerability reports for CPython and associated projects. Its work is essential to keeping millions of Python users safe. Last year alone, the team published 16 vulnerability advisories for CPython and pip—the highest number in a single year to date. The PSRT doesn’t operate in a vacuum; it actively involves project maintainers and subject-matter experts to ensure patches are reliable, maintainable, and minimally disruptive. By coordinating with other open-source projects—such as the recent PyPI ZIP archive differential attack mitigation—the PSRT prevents ecosystem-wide surprises. This behind-the-scenes labor is just as vital as code contributions and deserves recognition.
How Has the PSRT Improved Its Governance?
With the approval of PEP 811, the PSRT now has a formal public governance document. This structure mandates a published member list, clear responsibilities for members and admins, and a defined onboarding/offboarding process that balances security needs with team sustainability. The document also clarifies the relationship between the Python Steering Council and the PSRT. These changes make the team more transparent and resilient, ensuring that security work can continue smoothly even as members come and go. The new onboarding process is already bearing fruit: Jacob Coffee, the PSF Infrastructure Engineer, recently became the first new non–Release Manager member since Seth Larson joined in 2023. This milestone demonstrates the team’s commitment to bringing in fresh expertise.
Who Can Join the Python Security Response Team?
You do not need to be a core developer, team member, or triager to join the PSRT. The team welcomes anyone with relevant security expertise and a willingness to help. Members come from diverse backgrounds—some are experienced security researchers, others are long-time Python contributors who understand the codebase intimately. The only requirement is a nomination from an existing PSRT member and a positive vote from at least two-thirds of the current team. This inclusive approach aims to bring in fresh perspectives while maintaining a high trust level. If you have a strong track record of handling vulnerabilities or a deep understanding of Python’s security landscape, you are encouraged to connect with a current member and express your interest.
What Is the Nomination Process for Joining the PSRT?
The process mirrors the Python Core Team nomination process. First, you need a current PSRT member to nominate you. The nomination is then discussed privately among the team, and a formal vote is conducted. To be admitted, you must receive at least ⅔ positive votes from existing PSRT members. This high threshold ensures that new members are thoroughly vetted and trusted. Once approved, you’ll be onboarded with documented responsibilities and access to the team’s tools. The process is designed to be fair and transparent, allowing the PSRT to grow sustainably while preserving the integrity of security operations. If you’re interested, start by building relationships with current PSRT members—for example, by collaborating on security issues or contributing to Python’s vulnerability handling workflows.
What Are the Responsibilities of PSRT Members?
PSRT members are primarily responsible for triaging incoming vulnerability reports, coordinating with reporters and project maintainers, and overseeing the development of patches. They also help draft and publish security advisories. Importantly, coordinators are encouraged to involve subject-matter experts directly in the remediation process. This ensures fixes adhere to existing API conventions, align with threat models, and are maintainable long-term. Members also collaborate with other open-source projects when vulnerabilities affect multiple ecosystems. Additionally, the team is working on integrating GitHub Security Advisories to credit reporters, coordinators, and remediation developers in CVE and OSV records. This formal recognition helps ensure that everyone who contributes to a fix gets proper acknowledgment, even though the work often happens behind closed doors.
How Does the PSRT Collaborate with Other Projects?
Security vulnerabilities rarely respect project boundaries. When a flaw affects multiple ecosystems, the PSRT coordinates with other open-source projects to release advisories simultaneously, preventing one project from being caught off guard. A recent example is the PyPI ZIP archive differential attack mitigation. By working together with PyPI maintainers, the team ensured that both Python’s package management tooling and the registry itself were protected before any public disclosure. This kind of coordination requires trust and communication, but it’s essential for ecosystem-wide security. The PSRT also participates in cross-project initiatives like the Open Source Security Foundation to share best practices and threat intelligence.
How Is Security Work Being Recognized and Celebrated?
Traditionally, security work has been invisible—vulnerability fixes are often applied silently to avoid tipping off attackers. However, the PSRT is changing that by implementing workflows that ensure contributors are properly credited. Seth Larson and Jacob Coffee are developing systems that record the reporter, coordinator, and remediation developers in CVE and OSV records. This means that when you help fix a security bug, your contribution will be publicly acknowledged, similar to a code commit or documentation patch. The PSRT encourages celebrating these contributions just like any other. This recognition not only boosts morale but also encourages more people to get involved in security work. By improving transparency, the team hopes to build a stronger, more sustainable security community around Python.
Who Has Recently Joined and What Does It Mean for Sustainability?
Jacob Coffee, the PSF Infrastructure Engineer, recently became the first non–“Release Manager” member to join the PSRT since Seth Larson’s own addition in 2023. This milestone shows that the new onboarding process works and is attracting a wider range of expertise. The PSRT expects more members to follow, which will bolster the sustainability of Python’s security work. With a larger and more diverse team, the workload becomes lighter for individuals, and the team can respond to vulnerabilities more quickly without burning out volunteers. Support from sponsors like Alpha-Omega, which funds Seth’s role as Security Developer-in-Residence, has been crucial for this stability. Combined with clear governance, public membership, and a fair nomination process, the PSRT is building a foundation for long-term ecosystem security.