EuroPython 2026: Learning from the “not‑so‑secret” Python security cabal

I delivered this talk at EuroPython 2026, I'll update this blog post once the recording is available on EuroPython's YouTube channel. Below are the slides and full list of links and resources included. This talk is a continuation of a talk I gave a year ago: “Security Work isn’t Special” as the keynote for OpenSSF Community Day NA where I lamented on how security work didn't match other Open Source contribution models like documentation, community, or code contributions.

My work as the Security Developer-in-Residence at the Python Software Foundation is sponsored by Alpha-Omega. Thanks to Alpha-Omega for supporting security in the Python ecosystem.

Links and Resources§

• Slides
• Python Software Foundation Blog
• Python Insider Blog
• Security Work isn’t Special
• Security Line Goes Up by Hugo van Kemenade
• Vulnerability Reports are not special anymore by Filippo Valsorda
• LLM generated vulnerabilities by Linus Torvalds
• Python Security Policy and Threat Model
• Python Security Response Team
• PEP 811 - Defining Python Security Response Team membership and responsibilities

Wow, you made it to the end!

• Share your thoughts with me on Mastodon, email, or Bluesky.
• Browse this blog’s archive of 192 entries.
• Check out this list of cool stuff I found on the internet.
• Follow this blog on RSS or the email newsletter.
• Go outside (best option)