I've been meaning to file this bug for a few days. mgorny put out a call for help recently about checking whether recent Python 3.x security fixes needed to be backported, and it came up again today during a Python 2 removal debate. This bug is to keep track of things which may need backporting, any useful resources, and to ensure we don't forget.