The community page (where all the mailing lists and contact addresses are listed) say:

>Report potential security issues in Django via private email to [email protected], and not via Django's Trac instance or the django-developers mailing list