Pre-PEP: Python Security Response Team Membership and Operations

[sethmlarson (Seth Michael Larson)]

@malemburg

@sethmlarson

Adopt GitHub Security Advisories (GHSA) as the preferred reporting and ticket-tracking mechanism for vulnerability reports to specific projects (such as “CPython”, “pip”, etc).

Could you please elaborate on this part a little more. I am a bit worried that we’re digging ourselves too much into the Github platform by promoting such a choice in a policy document.

IMO, the choice of platform should be abstract in the policy and the SC and PSRT members can then decide on which tool to use.

Are there alternative platforms you could envision for the task ?

As @ncoghlan mentioned, there aren’t many tools that tightly integrate with GitHub to allow private “pull request”-like UI, vulnerability-specific tooling (such as CVSS, CVE ID, and CVE-specific crediting), already hooked up to our existing GitHub teams and admin, and for no cost. I couldn’t find any alternative that met all those criteria.

I can certainly abstract this out so that PSRT is able to choose its tool based on where the projects are hosted and what is available there.