...
We treat security-related issues specially. If you believe you have discovered a security issue related to SpamAssassin, please send a mail to security at spamassassin.apache.org with full details.
Anyone can send mail to the Security mailing list. Subscription to read the list is restricted. People who are granted commit access to the SpamAssassin project should subscribe to the list.
Private Lists
The project management committee maintains a private list, used for a very limited subset of discussions that cannot take place in public. This is not open for public subscription, but is documented here for completeness and transparency. See ProjectRoles for more details on what this list is used for.
...