Learning from the not-so-secret Python security cabal (EuroPython 2026)

The CPython runtime is some of the most-used software in the world. Part of maintaining a secure software project like CPython is participating in coordinated vulnerability disclosure (CVD). This process allows security researchers and maintainers of projects to work together to fix vulnerabilities and alert the public, keeping all Python programmers and users safe.

In this talk attendees will learn about how the Python language organizes its security team, how to balance security and open source contribution in coordinated vulnerability disclosure, and the latest in how open source projects can maintain a sustainable vulnerability disclosure program. Attendees that aren’t currently contributing to open source projects, but have an interest in their dependencies being secure, will learn ways they can contribute meaningfully to the security of open source projects they depend on.

https://ep2026.europython.eu/session/learning-from-the-not-so-secret-python-security-cabal

Transcript

1. Learning from the not-so-secret “Python security cabal” Seth Larson
2. Who am I? Seth Larson (@sethmlarson) Security Developer @ PSF Python Core Developer Python Security Response Team
3. Python Security Response Team “PSRT” security@python.org
4. “Security Work isn’t Special” OpenSSF Community Day NA 2025 Back in 2025…
5. “Vuln Apocalypse” LLMs with “Cybersecurity Capabilities” Mythos, Glasswing, GPT-Cyber, GLM-5.2 Why? Fast-forward to 2026
6. Why? …LLMs finding vulns Actual Before After
7. Why? …LLMs finding vulns Actual Before After 👀 “Fix this code”
8. Why? …LLMs finding vulns Actual Before After 👀 “Fix this code”
9. Why? …LLMs finding vulns Actual Before After 👀 “Fix this code”
10. Why? ...more opportunity! https://hugovk.dev/blog/2026/security-line-goes-up/
11. “AI detected bugs are… by definition not secret” Why? …secrecy isn’t as valuable
12. New Open Source Contribution Type Unlocked?!
13. Goal: Roadmap for Security Contributors • Why now? ~LLMs • How to contribute to security for a project? • As a project, how to accept contributions?
14. How to become a “Security Contributor”?
15. Vulnerability Lifecycle “CVE” Reporters ↓ Security Team ↓ Maintainers ↓ Users Report ↓ Triage ↓ Develop Fix ↓ Advisory Security Policy Threat Model
16. 🕹 Adversarial thinking 💬 Communication 🤝 Network with others ⚙ How is the software used? Develop Yourself ✅
17. Security Policy “CONTRIBUTING.md for security teams” ✅
18. Security Policy • Where to submit reports? • What to include in reports? • What behavior is acceptable? ✅
19. Security Policy ✅
20. Triage Reports Is this a vulnerability or a bug? Unsure? Threat Model!
21. Threat Model ✅
22. Triage Reports • Not a vulnerability? → Public issue • Otherwise: this is a vulnerability! • Calculate severity (CVSS) • CVE ID (Red Hat, GitHub)
23. Developing Fixes • Optional for Security Contributor! • Involve relevant contributors • Proof-of-concept to test case • Review the fix
24. Publish Advisory • Description of vulnerability • What versions or APIs affected? • CVE ID, Severity, Patch • Mitigations (how to fix without patch)
25. Security work has clearer benefit to company Time vs. $$$ Vouching via “@company” email ✅ Sponsored Time
26. ✖ Joining a security team to read or “lurk” Access means you are active ✖ Acting on info prior to disclosure Others are put in danger! What to Avoid ❌
27. How can Projects accept Security Contributions?
28. PEP 811 Governance Membership Processes
29. Ask for Help! Don’t struggle silently with security
30. Is secrecy hampering triage, fixing, or mental well-being? LLM-discovered reports, Low severity “Shadowing” or mentoring Accepting Help is Less Risky
31. • Ticket-based Reports! • LLMs only evaluate source control • AGENTS.md • Ban bad actors, Code of Conduct Tooling & Process
32. Open Source Security Teams are experimenting
33. Thank you! Thank you Alpha-Omega for sponsoring security @ PSF sethmlarson.dev Links and Slides pyfound.blogspot.com Python Software Foundation Blog