Introduction
The Python Security Response Team (PSRT) plays a crucial role in safeguarding the Python ecosystem. Thanks to recent governance improvements formalized in PEP 811, the PSRT now operates with a transparent public charter, a documented list of members, clear responsibilities, and a structured onboarding process. This new framework balances security needs with sustainability, making it easier for qualified individuals to contribute. If you have the skills and dedication to help triage vulnerabilities and coordinate fixes, joining the PSRT is a rewarding way to give back to the community. In this guide, we'll walk you through the steps to become a member.
What You Need
- Nomination by an existing PSRT member – You must be sponsored by someone currently on the team.
- At least 2/3 majority vote from current PSRT members in favor of your nomination.
- Relevant experience – While you don't need to be a Python core developer, you should have a strong background in security, vulnerability handling, or open source maintenance.
- Commitment to confidentiality – PSRT work involves handling sensitive security reports.
- Access to communication channels – Typically, you'll need to participate in private discussions and use tools like GitHub Security Advisories.
Step-by-Step Process
Step 1: Understand the PSRT’s Role and Responsibilities
Before seeking membership, familiarize yourself with what the PSRT does. The team is responsible for triaging and coordinating vulnerability reports for CPython, pip, and other Python-related projects. They work closely with maintainers and subject-matter experts to ensure fixes adhere to API conventions, have minimal impact, and are sustainable long-term. The PSRT also coordinates with other open source projects to prevent ecosystem-wide surprises—like the recent PyPI ZIP archive differential attack mitigation. You should be comfortable working behind the scenes and giving proper credit to all contributors.
Step 2: Assess Your Eligibility
The PSRT is open to individuals beyond the core developer circle. You do not need to be a core developer, triager, or team member to apply. However, you should have demonstrable expertise in security or relevant field, a track record of responsible disclosure, and a willingness to volunteer your time. The team values diversity of skills—whether you're a security researcher, an infrastructure engineer, or a long-time Python package maintainer.
Step 3: Find a Current PSRT Member to Nominate You
The nomination process is similar to the Core Team nomination process. You need an existing PSRT member to sponsor you. How to find one? Engage with the Python community: attend virtual meetings, contribute to security discussions on the Python security mailing list, or collaborate on vulnerability reports. If you've already worked with someone on the PSRT (like Seth Larson or Jacob Coffee, who recently joined as the first non-Release Manager member), ask them directly. Building a reputation through open source security contributions is the best path.
Step 4: Prepare Your Nomination Packet
While the exact requirements aren't publicly rigid, you should be ready to present your background and motivations. Work with your nominator to draft a brief statement covering:
- Your experience with security vulnerability handling.
- Any contributions to Python or related projects.
- Why you want to join the PSRT and how you plan to support its mission.
- Commitment to the team's confidentiality and sustainability goals.
Your nominator will present this to the rest of the PSRT for voting.
Step 5: Wait for the Voting Process
Once nominated, the current PSRT members will hold a private vote. Your nomination needs at least 2/3 positive votes to pass. The process is designed to ensure that new members are broadly accepted by the existing team. The timeline can vary, but the governance document (PEP 811) aims to make it efficient. Be patient; the team is committed to sustainability and will evaluate each candidate carefully.
Step 6: Onboarding After Acceptance
If your nomination succeeds, you will go through an onboarding process documented in the new governance structure. You'll receive access to private repositories, communication channels, and be assigned a mentor from the PSRT. You'll get familiar with their workflow using “GitHub Security Advisories” to record reporters, coordinators, and remediation developers, ensuring proper attribution in CVE and OSV records. You'll also learn how to coordinate with external projects when vulnerabilities affect multiple ecosystems.
Tips for Success
- Build credibility before seeking nomination. Contribute to CPython security, report vulnerabilities responsibly, or help improve security tooling.
- Network with current PSRT members. Attend Python security events, follow their work on GitHub, or join relevant mailing lists.
- Understand the PSRT’s need for sustainability. The team is evolving to balance security and workload. Show that you can handle responsibilities without burning out.
- Be ready to give and receive recognition. PSRT work is often invisible, but proper credit matters. The team is improving how contributors are acknowledged in CVE records.
- Don’t be discouraged if you aren’t accepted immediately. Keep contributing; the PSRT values ongoing involvement and may remember you for future openings.
Joining the Python Security Response Team is a meaningful way to protect millions of Python users. With the new transparent governance, the path is clearer than ever. Good luck!