To report security issues with projects under the Pylons Project send email to: firstname.lastname@example.org. If we determine that your report may be a security issue with the project, we may contact you for further information. We volunteers ask that you delay public disclosure of your report for at least seven days from the date you report it to us to allow sufficient time for us to process your report.
Once verified and fixed, we will:
- report it publically to the MITRE Corporation to its Common Vulnerabilities and Exposures (CVE) List, which in turn submits those to the National Vulnerability Database (NVD),
- make a bug-fix release,
- and send an announcement through our usual channels, including those listed on Contact.
Mail list / Google Group
For help with Pylons Project projects, and to reach the largest audience (over 2800 participants), including requests for help with your code, you may post to the pylons-discuss mail list.
Stack Overflow is a question and answer website that is very popular with developers. Questions may be tagged with the project's name, such as Pyramid or WebOb. You may search for related questions, or ask new questions which will notify the tag's followers.
#pyramid on IRC
Pylons Project developers (150-250 participants) are also generally available on the #pyramid channel on the Freenode IRC Network.
GitHub issue trackers
GitHub is the least desirable option. Posting a request for general support to the project's GitHub issue tracker reaches the smallest audience, and takes time away from fixing bugs and adding features. Please don't be "that person".
Using Support Wisely
Before asking a technical question on a mail list or in IRC, please make sure to try the following things (paraphrased from Before You Ask):
- Reading the manual.
- Searching the mail list archives.
- Searching Stack Overflow.
- Searching the Web.
- Try to find an answer by inspection or experimentation.
- If you're a programmer, try to find an answer by reading the source code.
After exhausing these avenues, it's completely appropriate to ask a question on the pylons-discuss mail list or #pyramid and #pylons IRC channels. When you ask your question, please describe what you've learned from the efforts above, as it will help the developers focus on answering your question quickly. It also helps tremendously if you are able to provide a code or configuration snippet that makes the problem easily repeatable.
See also the section "Reporting a Bug" under How to Participate.