The community page (where all the mailing lists and contact addresses are listed) say:

>Report potential security issues in Django via private email to security@djangoproject.com, and not via Django's Trac instance or the django-developers mailing list