Breaking News: Python Security Response Team Adopts Public Governance
The Python Security Response Team (PSRT) has officially adopted a new public governance framework under PEP 811, marking a major step toward transparency and sustainability. The policy, driven by Security Developer-in-Residence Seth Larson, establishes clear membership lists, documented responsibilities, and a structured onboarding process.
"This governance document ensures that security work can scale without burning out volunteers," said Larson. "We now have a sustainable way to bring in new members while maintaining the highest security standards."
Background
Until now, the PSRT operated without a formal public charter. Members were largely selected from the pool of Python Release Managers, leading to a small, overburdened team. The new policy, approved after months of community discussion, clarifies roles and the relationship with the Python Steering Council.
Already, the process is bearing fruit. Jacob Coffee, the Python Software Foundation’s Infrastructure Engineer, has joined the PSRT as the first non–Release Manager member since Larson’s own appointment in 2023. "Jacob’s infrastructure expertise is a huge asset," Larson noted. "We expect more diverse experts to follow."
What This Means
For Python users, this means faster, more coordinated responses to security vulnerabilities. The PSRT handled a record 16 advisories last year for CPython and pip alone, and the new structure should increase that capacity.
The team also plans to credit contributors more formally via GitHub Security Advisories, ensuring that reporters, coordinators, and fixers receive recognition in CVE and OSV records. "Security contributions deserve the same celebration as code commits," said Larson.
Broader Ecosystem Impact
The PSRT doesn’t work in isolation. It coordinates with other open-source projects to prevent cascading vulnerabilities, as seen in the recent PyPI ZIP archive differential attack mitigation. The governance change reinforces this collaborative approach.
How to Join
Interested in helping? You don’t need to be a core developer. Any existing PSRT member can nominate you, and a two-thirds vote from the team is required. Nominees are evaluated on their security experience and willingness to volunteer.
"We’re looking for people who can triage reports and work with maintainers," Larson explained. "If you have a background in security engineering or incident response, consider reaching out to a current member."
Acknowledgments
This work is supported by Alpha-Omega, which funds Larson’s Security Developer-in-Residence role at the Python Software Foundation.