Well, ok, but a link or explanation of that somewhere on the tracker would be
helpful.  Eventually it may be worth adding this, depending on how the
maintainers want to handle such reports.  I know that launchpad and bugzilla can
accept private reports and the feature is helpful.  They also normally serve
pages through SSL which should be more secure than email.  Anything really
sensitive is probably better off on a single well-secured server than in the
mailboxes of N different maintainers.  However, this probably isn't an
overriding issue for Python right now.