Mechanism to submit security issues

[itamarst]

Hi, I had a security issue I wanted to report, and there's no mechanism to do it privately at the moment.

[indygreg]

Email me. gregory.szorc@gmail.com.

[itamarst]

When you have time, let me know if you the thing I sent via email is something you consider to be a problem.

[zanieb]

Yes we're addressing it in #350

[itamarst]

Thank you! Are you thinking about the broader process issue too? I.e. rebuilding existing Python versions when a new OpenSSL version comes out? (I imagine other dependencies may also be an issue, this just seemed like the most obvious one to check.)

[zanieb]

Well, we'll rebuild the latest patch versions but we can't rebuild them all because it's too much to build.

And yeah, I'm trying to figure out a better way to get notified and otherwise automated dependency updates. I just manually checked everything and opened >15 PRs but it was pretty tedious.

[itamarst]

Oh, yeah, I meant rebuilding latest patch revision only. Older patch revisions will have Python security vulnerabilities too, after all.

[zanieb]

Thanks!

[itamarst]

Thank you!