3.1   Deb Nicholson

• Support various hiring processes that are happening in the org
• Work with Accounting team (both internal and fractional) to start plans for 2027, looking at updating reporting styles
• Continue to support Packaging Council and PSF Board election work
• Respond to administrative legal emails
• Conduct annual reviews for all reports
• Investigate ways to bring costs down for PyCon US 2028 and 2029
• Spoke at PyCon Korea and met with our sponsors and key volunteers there.
• Speaking at Rust Conf this month

3.2   Oliva Sauls

• PyCon US 2028/2029 RFP and city selection
• PyCon US 2026 budget wrap-up
• PyCon US 2027 hotel block renegotiation
• Attended DjangoCon US 2026
• PyCon US 2027 timeline, vendor selection & planning
• PyCon US 2027 design work
• PSF board minutes, public records and admin
• Managing Community Events Coordinator

3.3   Laura Graves

• Ongoing accounting activities
  • Insurance policy review and renewal
  • Reconciliation of BCBS bills for 2026 and updating payroll
  • Bringing reconciliations up to date
  • Working through coding discrepancies in PyCon budget
  • Review of all 2025 expense transactions
  • In-kind review and entries for 2025/2026
• Fiscal Sponsorship
  • Working with Kelly on updates to CPython reporting
  • PyLadies Auction 2026 reporting
  • North Bay Python contract review
  • PyBay contract review
• PyCon
  • Budget to actuals for 2026
  • Full review of 2026 budget sheet and fixing calculation errors, missing cell references, and formula mismatches
• Reporting
  • Closing Vermont employment account
  • Working with state of Massachusetts to get an overpayment refund
  • Contacting state of Ohio regarding unemployment notifications
  • File Vermont WHT-434 to close withholding account
  • Researching Maryland unemployment and withholding balances
  • Work on 2025 990
  • Resolving prior-period state employment tax and registration compliance gaps (Minnesota, Georgia, Illinois, Washington)
• Human Resources
  • Working with management on compensation adjustments for 2026
  • Classing and mapping 2026 payroll
  • Submitting proof of unemployment insurance to the state of Massachusetts

3.4   Loren Crary

• Correspondence with current and prospective sponsors
• Contract negotiation with current and prospective sponsors
• Assessing and pursuing grant opportunities
• Drafting and revising strategic public communications
• PyCon US planning support
• Board relations
• Strategic Planning support
• Strategic team management and support
• Policy review support
• Managing Programs Director & Community Communications Manager
• Working on planned hire to support fundraising

3.5   Marie Nordin

• Program Administration
  • Fellows
    • Kickoff of Q3 review period
  • Community Partner Program
  • Meetups
  • Office Hours
• PSF Board & Python Packaging Elections
  • Project management
  • Communications
  • Resolving individual membership issues
  • Coordination, publication, and promotion of PSF Board candidate written interviews
  • AMA thread coordination
  • Assist with setting up OpaVote
• Grants
  • Management of funding round
    • Review calls with GWG
    • Additional office hours
    • Communications with applicants
• Communications & promotion
  • Supporting staff communications (blog posts, social posts)
  • Python Typing Survey
  • Sponsor benefits communications
• Python Developers Survey
  • Coordination of review/analysis of 2026 data
  • Laying groundwork with stakeholders for updates to the Python Survey
• D&I WG
  • Supporting D&I WG office hours
• Strategic Plan
  • Follow-ups on publication & promotion on finalized plan

3.6   Seth Larson

• Hiring a new Security Developer at the PSF
  • The majority of Seth's time in August was spent creating interview materials and scheduling and conducting resume reviews, screen interviews, and technical interviews for candidates for the new PSF Security Developer position. Seth will be the hiring manager for this role.
• Python Security Response Team
  • Created a script for recording GHSA/PSRT activity metrics and shared early results with the PSRT.
  • Discussed with Steering Council the nomination process and PEP 811 removal procedures which will run in October.
  • PSRT published 5 advisories in August, created CVE records for each.
  • Updated the PSRT GHSA bot to automatically add reviewers and remediation developers to the credits for CVEs.
    • https://github.com/python/psrt-ghsa-bot/commit/b07aff49fdaab969431b2e3c68749746110dd85d
• When str.lower() is a security vulnerability in Python
  • Remediated a security vulnerability in CPython (CVE-2026-17084) affecting the implementation of IDNA 2003 (aka: NamePrep) which gave incorrect results due to the drifting implementation of case-folding (AKA, .lower()) in Python since Unicode 3.2.0. New Unicode versions meant the behavior of .lower() changed over time, leading to the vulnerability. Seth was the coordinator and remediation developer for this vulnerability. Seth wrote a blog post detailing the vulnerability which went viral on HackerNews, sitting on the front page for the majority of the day and garnering >11,000 page views in one day.
• Other items
  • Completed PSF annual review process for the SDIR role including goal-setting for the upcoming year which included having a direct report for the first time, making work more delegatable, and creating a public security roadmap for the Python ecosystem and language.
  • Seth was invited to speak on the Real Python podcast about his EuroPython security talk ("Learning from the not-so-secret Python security cabal") and generally about security work at the Python Software Foundation.
  • Seth was interviewed by IEEE Spectrum for an article about "Slopsquatting" and "Phantom Squatting".
  • The PSF CVE Numbering Authority (CNA) was reassigned a CVE ID that was erroneously assigned to Flask outside of CNA Rules. This CVE has been marked as disputed.
  • EuroPython talk recordings published:
    • Learning from the not-so-secret Python security cabal
    • AI and Cybersecurity Panel
  • Reviewed pre-PEP for security URLs on PyPI projects:
    • https://discuss.python.org/t/adding-security-as-a-well-known-url-label-and-project-security-table-to-pyproject-toml
  • Reviewed blog post about PyPI download metrics change
    • https://ithub.com/pypi/warehouse/pull/20476

3.7   Mike Fiedler

• Malware & Abuse Response
  • 157 new reports arrived in the security inbox during August; 135 of them were malware reports. 127 ended with a project removed, four were false alarms, and Mike sent 277 replies across 561 threads. Median resolution was just under 15 working hours, with 88% closed within one business day.
  • Mike also closed 96 reports carried over from earlier months, 56 of them from a single coordinated abuse campaign first reported in May. Because they were tracked as one group, they sat open for months and then all closed on August 25th once the scope was clear. The inbox also handled 9 frozen account inquiries, 5 legal and takedown requests, and a request to reclaim an abandoned project name.
  • Admin work followed from the queue. PyPI now shows whether an account is frozen in the IP address list, the security UI flags files added long after their release, and the typosquatting detector got a corroboration fix and a move into a background task to keep it off the upload path.
• Account Safety & Email Reputation
  • After Anthropic published a disclosure about incidents involving its cybersecurity evaluations, Mike pulled download evidence for the affected project and corresponded with their team. As a result, Mike rate-limited email changes. Mike evaluated usercheck.com as a source of disposable and low-reputation email signals, then scaffolded an email reputation interface with a null default and added the UserCheck backend behind it (pending review). Related work routed email blocklist writes through a single helper and produced better visibility into account registrations while looking into a silent CAPTCHA failure.
  • Mike shipped measurement of macaroon caveat attenuation to find out how publishers scope their tokens in practice, feeding the ongoing discussion about long-lived tokens for API surfaces.
• Trusted Publishing
  • A second round of review on the CircleCI Trusted Publisher contribution is going slowly, but it has been a good look at how much publisher-specific logic PyPI keeps accumulating. Mike also reviewed burning Trusted Publishing tokens after use. On provenance, statuses and per-project counts shipped, and Mike reviewed and updated release provenance statuses.
• Infrastructure & Reliability
  • Most of the infrastructure time went to elevated 5xx responses on file hosting. Mike traced a class of 501s to Fastly's segmented caching mishandling range request suffixes, which produced a support ticket and four changes: rejecting non-useful headers, a workaround, more caching exclusions, and URL normalization ahead of the caching checks. He also fixed the B2 fallback logic.
  • Elsewhere: logging only actual package downloads and a blog post on download counts; an XMLRPC refactor from orjson to the standard library JSON renderer that closed an inbound security report, with cache metrics.
• Community Engagement
  • AWS Hero Summit in Seattle, including 20 minutes at the Heroes Unconference on PyPI, the PSF
  • Delivered a Trusted Publishing talk to the NYC Open Source Security User Group
  • OpenSSF Securing Software Repositories working group, plus a UI/UX session on showing late-added files and publisher provenance to users
  • Two Alpha-Omega Open Source Corps of Engineers sessions, PSF Board meeting
• Other Items
  • Admin user account export, and continued conversion of admin tables from DataTables to Tabulator (20446, 20445, 20457, 20474)
  • Runtime upgrade to Python 3.14.7 for security fixes, plus Node.js, cryptography, and JavaScript dependencies flagged in vulnerability reports
  • Continued migrating the test suite away from pretend, with test ordering and makefile improvements, and reviewed inline snapshot testing and memory allocation measurement
  • Released readme-renderer 46.0
  • Reviewed sparse tar member handling, project description UI, entrypoint upload failure metrics, and assorted UI changes
  • Routine dependency updates across warehouse, linehaul-cloud-function, conveyor, and stdlib-list, and a review of the draft PSF annual impact report

3.8   Jaime Barrera

• Helpscout inbox
• Onboarding Board meetings w/Olivia for Board meeting responsibility
• Sponsor sessions, Charlas, Talks - new versions reviewed and made LIVE on YouTube
• Removed YouTube duplicate videos and filed them in the Do Not Publish folder
• Worked on the PyCon 2027 conference attendance certificate
• Sponsor email notification
• Collected photos of the sponsors' sessions to share with sponsors in the sponsor session notification email
• Working with Reilley and Olivia on RFP for 2028/2029 venues
• Worked on the September Board meeting agenda

3.9   Jacob Coffee

September report not provided.

3.10   Maria Ashna

September report not provided.

3.11   Kelly Ragland

• COMPLETED & OPERATIONAL
  • Financial Operations & Fundraising
    • Built a donor-matching pipeline for the 2025 Form 990 Schedule B — cross-referencing accounting and CRM donor records, splitting and cleaning address data, classifying business vs. individual donors, and flagging uncertain matches for manual review. Used it to compile the $5,000+ donor list and produce a draft Schedule B.
    • Worked with Laura and Sutro Li to clean up the remaining 2025 financial data and prepare to close out the year.
    • Worked with Laura on the CPython financial report and identified a few adjustments that need to be made. In process of completing those so a new financial report can be sent to Thomas.
    • Resolved an issue uploading PyCon sponsor invoices to our vendor management platform, affecting two sponsors.
  • Thanks.dev Platform Reconciliation
    • Spent time untangling how Thanks.dev works end-to-end. Identified a dormant contribution stream where Thanks.dev had been collecting PSF funds since 2024 without payouts being initiated (payouts must be manually initiated) — an access/control gap that had left the account unmanaged. Coordinated release of the outstanding balance (~$14K), consolidated income and payout reporting across the platform's related channels, and worked out how the payment-initiation and recording process needs to function going forward. Built a full multi-tab reconciliation workbook covering four years of Thanks.dev income and payouts across all relevant fiscal sponsorees (Pallets, Twisted, PyPA, PSF), using a FIFO waterfall method to attribute payouts back to the correct prior fiscal years, and shared findings with Laura and Sutro Li for review.
  • Financial Systems & Automation
    • Completed individual financial reports for additional fiscal-sponsorship programs and continued improving the process for compiling them, including adding a safeguard after auditing the Temporarily Restricted Net Assets register to ensure all incoming transfers for fiscal sponsorees are captured in their reports.
    • Continued improving the Stripe-to-QuickBooks import process, flagging any charge it can't confidently match for manual review. Identified an error where a Stripe extension was incorrectly recording CiviCRM donation descriptions and flagged it for JMA to troubleshoot and submit a fix back to the extension's maintainer.
    • Continued improving the PayPal-to-QuickBooks import process, refining donation account mapping.
    • Sent out PyCon 2026 volunteer/staff gift letters for signature so payments can be issued.
• IN PROGRESS & ONGOING
  • Building off the fiscal-sponsoree fund activity reporting process, worked on a similar year-over-year financial workbook for the Board, targeting the October 2026 board meeting for presentation.
  • Revisited capturing referrer URLs from CiviCRM donors to better understand what drives giving; since the current field wasn't collecting useful data, worked with Mike and JMA to land on a new approach using UTM parameters, with implementation next.
  • Maintain receivables accounts and use existing pipelines to bring in financial data from various donor platforms and sources.
  • Manage the PSF donations inbox — responding to and resolving donor questions about CiviCRM accounts and donations.
  • Meet with Fiscal Sponsorees (FS)
  • Send agreements and invoice for PSF and FS sponsorships

3.12   Sutro Li

• Onboarding with Finance Team
  • Weekly Sutro Li and PSF Finance Team meetings
  • Begin use of Ramp software for AP processing (domestic payments only)
• Accounting and Finance
  • Earth Class Mail management
  • Payroll Accounting
    • Continue with posting payrolls for 2026
• Stripe & Stripe Express Accounting
  • Finalize Stripe and Stripe Express (GitHub) transactions through December 31, 2025
• Bank Account Review and Reconciliation
  • Continue coding uncoded bank lines for Jan-June 2026, including matching receipts to invoices and payments to bills
  • Correct balance in Undeposited Funds through December 31, 2025
  • Continue with bank reconciliations of cash and cash equivalent accounts for 2026
• Additional Balance Sheet Reconciliations through December 31, 2025
  • Verify Accounts Receivable and Accounts Payable balances
  • Correct Allowance for Doubtful Accounts
  • Update prepaid expenses schedule due to coding changes for PyCon event costs
  • True up credit card points receivable balance
  • Correct and reconcile payroll liability balances for 2025, including payroll taxes payable, retirement benefits payable and employee benefits payable
  • Confirm accuracy of sales tax payable balance
• Deferred Revenue Review
  • Comparison of sponsorship agreements to invoices in QBO
  • Correct balances for all deferred revenue accounts through December 31, 2025
  • Create 2025 schedule of deferred revenue as of December 31, 2025
• General Ledger Review
  • Pull 2025 general ledger for review
  • Post all coding changes identified by PSF Finance Team for 2025
• Allocations
  • Prepare 2025 staff effort table for PSF Finance Team to record effort percentages
  • Record 2025 personnel allocations by department
• Support with additional year-end adjustments for 2025

3.13   Abigail Mesrenyame Dogbe

• Education and Outreach Workgroup work and meetings
• Spoke at the PyCon Africa live Office Hours sharing community updates and encouraging members to vote in the elections
• 2026 board elections work
• PSF Office Hours
• PyLadiesCon 2026 planning and program

3.14   Sheena O'Connell

• Assist PyConZA with bus factor (small grants focused on Southern Africa) and beginners day
• Guild of educators: Book club and community wrangling
• Education and outreach wg: mostly connecting dots

3.15   Denny Perez

September report not provided.

3.16   Cristián Maureira-Fredes

• PSF: Office hours, meetings, and EC related discussions.
• Community - EuroPython Society: Finalizing some conference aspects and meetings on some future decisions for the organization and other society details.
• Community - PyLadiesCon: Discussions around 2026 versions, and handling some difficulties related to the execution and details of a new version.

3.17   Simon Willison

• PSF board discussions + board meeting
• Election committee
• Community: Promoted testing of 3.15 RC2

3.18   Jannis Leidel

September report not provided.

3.19   Georgi Ker

September report not provided.

3.20   KwonHan Bae

• PSF - participated in board discussions via Slack and email
• PSF - attended board meeting
• COMMUNITY: Python Asia Organize
• COMMUNITY: PyCon KR 2026 Organize
• COMMUNITY: attend PyCon JP 2026
• COMMUNITY: Draft Supply Chain Attack in Korea and Japan

3.21   Tania Allard

September report not provided.

3.22   Cheuk Ting Ho

• Election committee
• Grants application review
• Spoke at PyCon KR, PyCon JP and PyCon PT

3.23   Chris Neugebauer

• Getting North Bay Python 2027 up and running
• PSF Board Executive Committee work
• Reviewed strategic plan documents

4.1   Code of Conduct

• Nothing to report at this time.

4.2   Grants

• Nothing to report at this time.

4.3   Sponsors

• Nothing to report at this time.

4.4   Marketing

• Nothing to report at this time.

4.5   Jobs

• Of the 508 Job submissions created in September 2026:
  • 149 have status approved
  • 3 have status archived
  • 10 have status draft
  • 148 have status expired
  • 101 have status rejected
  • 89 have status removed
  • 8 have status review

4.6   Trademarks

• Nothing to report

4.7   Fellows

• Nothing to report

4.8   Packaging

• Nothing to report

4.9   Infrastructure

• Nothing to report

4.10   Scientific Python

• Nothing to report

4.11   Diversity & Inclusion Work Group

• Nothing to report

6.1   Grants

• Nothing to report

6.2   Sponsors

• None at this time.

6.3   Scientific Python

• None at this time.