Santos Gallegos

Lessons Learned Reporting Vulnerabilities in the Python Ecosystem

You've surely received that notification telling you to update a dependency due to a security flaw. But have you wondered what happens from when someone discovers that vulnerability until the patch reaches your project? In this talk I'll share my experience reporting vulnerabilities in the Python ecosystem. We'll explore the behind the scenes: from the technical finding and reporting process to collaboration with maintainers and patch publication. We'll address not only technical aspects but also the human factor—both crucial for effective vulnerability resolution. The challenges maintainers and the community face, especially in this new era of open source software security where artificial intelligence plays an increasingly relevant role.