Document where security issues should be reported

[pradyunsg]

What's the problem this feature will solve?

It’s unclear to users/researchers where they should report security issues in pip.

Describe the solution you'd like

Document that they should email security@python.org with their report and reproducer.

Alternative Solutions

Not documenting it, or listing specific maintainers as security contacts.

Additional context

#11033

Code of Conduct

• I agree to follow the PSF Code of Conduct.

[pradyunsg]

Also discussed in #10928

[sandeepkiran-js]

Is this issue still open for contribution - Changes in documentation to add contact for reporting to security issues

[pradyunsg]

Yes, we need to document that security issues should be reported to security@python.org

[sandeepkiran-js]

This is my first contribution , so should i make changes in https://github.com/pypa/pip/blob/main/docs/html/index.md

Old content:
< end of file >
If you find bugs, need help, or want to talk to the developers, use our mailing lists or chat rooms:

GitHub Issues
Discourse channel
User IRC
Development IRC

New content:

If you find bugs, need help, or want to talk to the developers, use our mailing lists or chat rooms:

GitHub Issues
Discourse channel
User IRC
Development IRC

< new content here>
If you find any security issues , please report to security@python.org

[sandeepkiran-js]

@pradyunsg ,Pull Request: #11140

[uranusjr]

I guess this can be closed now