[simonw]

I don't know that myself but Mike Fiedler is the person to reach out to, he runs security for PyPI and is very responsive. [e-mail]