Python establishes new governance for Security Response Team via PEP 811

The Python Software Foundation has approved PEP 811, establishing a public governance document for the Python Security Response Team (PSRT). This new structure defines member responsibilities, onboarding/offboarding processes, and the team's relationship with the Python Steering Council. The first non-Release Manager member, Jacob Coffee, has already joined under this new framework.

New PSRT Governance and Membership

• PEP 811 provides the formal governance framework for the PSRT.
• The team now maintains a public list of members and documented administrative responsibilities.
• Membership requires a nomination by an existing member and a two-thirds majority vote from the current team.
• Security expertise is required, but candidates do not need to be core developers or team members.
• The team is working on improving GitHub Security Advisories workflows to better attribute reporters and reviewers in CVE and OSV records.

Why it matters

The formalization of the PSRT aims to ensure the long-term sustainability of security coordination for CPython and pip.