<p dir="auto"><a href="http://pandas.pydata.org/developers.html" rel="nofollow">http://pandas.pydata.org/developers.html</a></p>
<ul dir="auto">
<li><a href="https://mail.python.org/mailman/listinfo/pandas-dev" rel="nofollow">https://mail.python.org/mailman/listinfo/pandas-dev</a></li>
</ul>
<p dir="auto">Examples:</p>
<ul dir="auto">
<li><a href="https://en.wikipedia.org/wiki/Responsible_disclosure" rel="nofollow">https://en.wikipedia.org/wiki/Responsible_disclosure</a></li>
<li><a href="https://docs.djangoproject.com/en/dev/internals/security/#reporting-security-issues" rel="nofollow">https://docs.djangoproject.com/en/dev/internals/security/#reporting-security-issues</a></li>
</ul>
<p dir="auto">Part of the tidelift setup. In <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="440456666" data-permission-text="Title is private" data-url="https://github.com/numpy/numpy/issues/13475" data-hovercard-type="issue" data-hovercard-url="/numpy/numpy/issues/13475/hovercard" href="https://github.com/numpy/numpy/issues/13475">numpy/numpy#13475</a> / <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="440876233" data-permission-text="Title is private" data-url="https://github.com/numpy/numpy/issues/13485" data-hovercard-type="pull_request" data-hovercard-url="/numpy/numpy/pull/13485/hovercard" href="https://github.com/numpy/numpy/pull/13485">numpy/numpy#13485</a>, NumPy decided to just link to <a href="https://tidelift.com/docs/lifting/security" rel="nofollow">https://tidelift.com/docs/lifting/security</a>. That should suffice to us.</p>
<p dir="auto">Only thing to decide is who all gets notified with these reports.</p>