# Where to report \`python.org\` infrastructure (not language) security issues **URL:** \ **Category:** Ask the staff!\ **Tags:** help\ **Created:** [January 3, 2026, 3:23pm UTC](https://discuss.python.org/t/where-to-report-python-org-infrastructure-not-language-security-issues/105498 "2026-01-03T15:23:30Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![croemer](https://sea2.discourse-cdn.com/flex002/user_avatar/discuss.python.org/croemer/32/17780_2.png) [@croemer](https://discuss.python.org/u/croemer)\ **Post date:** [January 3, 2026, 3:23pm UTC](https://discuss.python.org/t/where-to-report-python-org-infrastructure-not-language-security-issues/105498/1 "2026-01-03T15:23:30Z")
I found a minor security issue on a Python domain (related to PSF infrastructure, not Python the language) and discovered that `python.org` doesn’t seem to publish a `/.well-known/security.txt` file at the moment. The Python security docs are not applicable as this isn’t about a vulnerability in Python but server/website related. Pypi has `security@pypi.org` - I couldn’t find something like that for `@python.org`. This might be a good thing to put into a `/.well-known/security.txt` file, see [https://securitytxt.org/](https://securitytxt.org/) Replies here aren’t time critical, I’ve already emailed [psf@python.org](mailto:psf@python.org). Emails to `psf@python.org` get the following auto-reply which again doesn’t mention security: > Subject: Auto-response for your message to the “PSF-Board” mailing list > > From: [psf-board-bounces@python.org](mailto:psf-board-bounces@python.org) > > !!PLEASE READ!! > > Thank you for reaching out to the PSF. This is an auto-respond > message. > > For help with Python development and or technical questions, please > email [help@python.org](mailto:help@python.org). > > For grant requests and sponsorships, please see > [PSF Grants Program | Python Software Foundation](https://www.python.org/psf/grants/) for requirements and instructions > on how to submit your request. > > For fiscal sponsorship questions, please email > [fiscal-sponsors@python.org](mailto:fiscal-sponsors@python.org). > > For PSF related requests, we will respond to your email within a > couple business days. ---
**Author:** ![barry](https://sea2.discourse-cdn.com/flex002/user_avatar/discuss.python.org/barry/32/42_2.png) [@barry](https://discuss.python.org/u/barry)\ **Post date:** [January 3, 2026, 5:46pm UTC](https://discuss.python.org/t/where-to-report-python-org-infrastructure-not-language-security-issues/105498/2 "2026-01-03T17:46:45Z")
> [@croemer](#): > > I found a minor security issue on a Python domain [security@python.org](mailto:security@python.org) is appropriate for this. See also the [Python Security page](https://www.python.org/dev/security/). ---
**Author:** ![croemer](https://sea2.discourse-cdn.com/flex002/user_avatar/discuss.python.org/croemer/32/17780_2.png) [@croemer](https://discuss.python.org/u/croemer)\ **Post date:** [January 3, 2026, 6:39pm UTC](https://discuss.python.org/t/where-to-report-python-org-infrastructure-not-language-security-issues/105498/3 "2026-01-03T18:39:46Z")
> [security@python.org](mailto:security@python.org) is appropriate for this. See also the [Python Security page](https://www.python.org/dev/security/). Thanks for the suggestion. I had read the security page before making this post here and on my reading `security@python.org` seemed to be about Python _language_ and _package_ vulnerabilities not about project-website related issues - and I didn’t want to bother the security response team with this more operational report. I’ve now forwarded the email to that address as well, though.