public/virtualenv.pyz is the zipapp bootstrap.pypa.io serves. virtualenv's release workflow builds it, attests its provenance and commits it here, so a flaw in the zipapp is a flaw in virtualenv.

Report vulnerabilities through virtualenv's security policy; its advisory form takes private reports. That policy covers these files too.

That policy sets the timelines: an acknowledgment within 5 working days, an assessment within 15, and coordinated disclosure through a published advisory after a default 90-day embargo.

Verify a release shows how to check that a downloaded virtualenv.pyz came from that workflow.