How to report a security bug of pip?

[ycdxsb]

Description

Hello,
I want to know how to report a security bug of pip.
Thank you.

Expected behavior

None

pip version

22.0.4

Python version

3.10.4

OS

windows

How to Reproduce

None

Output

None

Code of Conduct

• I agree to follow the PSF Code of Conduct.

[potiuk]

There is no policy in pip I reported a but to security@python.org some time ago. Worked.

[ycdxsb]

There is no policy in pip I reported a but to security@python.org some time ago. Worked.

security@python.org reject my report because it's not a security bug about python.

[potiuk]

🤷 - no idea then

[uranusjr]

cc @pradyunsg we talked about this the other day

[ycdxsb]

cc @pradyunsg we talked about this the other day

Is there an email like security@python.org to accept report?

[uranusjr]

From previous discussion security@python.org is the one to use, and I’m surprised it rejected it (first time I’ve heard that happened). I don’t think there’s another dedicated mailing list for this, the closest alternative would be to find maintainers’ emails on GitHub and email privately.

(I’m going to raise this issue in the Packaging Summit next month at PyCon)

[uranusjr]

Linking #10928

[ycdxsb]

From previous discussion security@python.org is the one to use, and I’m surprised it rejected it (first time I’ve heard that happened). I don’t think there’s another dedicated mailing list for this, the closest alternative would be to find maintainers’ emails on GitHub and email privately.

(I’m going to raise this issue in the Packaging Summit next month at PyCon)

Thanks, I will send the report to you later.

[pradyunsg]

Closing in favour of #11037, given that OP has reached out.

[pradyunsg]

I don't see any reports from OP on security@python.org. Could you forward the email that you sent to security@ to me?