Mailman is being developed on SourceForge. Please use the SourceForge bug tracker to report any bugs.. If you have patches you'd like to submit, the best place to do that is on the SourceForge patch manager.
Be sure to select the right group for your bug or patch, e.g. Mailman 2.1. Failing to do so may cause your submission to get overlooked. It is also recommended that you email a note about your submission to the mailman-developers mailing list, but don't rely on just the email to get the attention of the Mailman developers.
Security related bugs should be posted to mailman-cabal@python.org. This is a small, closed, distribution list so it's better to post security related bugs here instead of to any of the public mailing lists.