# Security Policy

Python [provides a security policy and threat model](https://devguide.python.org/security/policy/)
in the Python Developer's Guide documenting what bugs are vulnerabilities,
how to structure reports, and what versions of Python accept reports.

Python Security Response Team (PSRT) members
balance security work against many other responsibilities. Please be thoughtful
about the time and attention your report requires. Repeated failure to respect
the security policy will result in future reports being rejected, or the
reporter being banned from the ``python`` GitHub organization, regardless of
technical merit.

## Reporting a Vulnerability

The [Python security policy](https://devguide.python.org/security/policy/)
documents [how to submit a vulnerability report](https://devguide.python.org/security/policy/#how-to-submit-a-vulnerability-report)
using GitHub Security Advisories. Please read the security policy
prior to filing a vulnerability report, especially the section on [what information to
include and exclude](https://devguide.python.org/security/policy/#what-to-include-and-how-to-structure-a-vulnerability-report)
in vulnerability reports. Following the security policy means the PSRT can
quickly and efficiently triage your report, not following the security policy
will only delay triaging your report.

