> The tracker doesn't appear to have a way to privately report a security problem.

That's mostly intentional. Issues that shouldn't be disclosed should be 
reported to security@python.org.

Regards,
Martin