Python powers over 40% of new backend services started in 2025, according to the Stack Overflow Developer Survey, and it also sits behind some of the most consequential supply chain incidents of the last three years: the ctx and phpass typosquat campaigns, the ua-parser-js-style compromise of python-ua-parser, and thousands of PyPI packages caught mimicking popular libraries. Security teams inheriting Python codebases are usually fighting three problems at once: an ecosystem with no built-in package signing until recently, a dependency graph that balloons fast (a typical Django app pulls 60-120 transitive packages), and a language flexible enough that pickle.loads() or eval() calls slip into production without review. This cheat sheet skips the generic "keep dependencies updated" advice and gives specific commands, version thresholds, and configuration you can apply this week to close the gaps attackers actually use.
Python security best practices cheat sheet
A no-fluff cheat sheet of concrete Python security fixes—dependency pinning, pickle/eval risks, PyPI trust signals, and CI gates—with real CVEs and commands.
More on #python-security
View allurllib3 CA certificate verification bypass (CVE-2019-11324)
urllib3 regular expression denial of service (CVE-2021-33503)
urllib3 cookie/auth header leak on cross-origin redirect (CVE-2023-43804)
PyYAML full_load unsafe deserialization arbitrary code execution (CVE-2020-14343)
Related articles in Application Security
The One Line of Ordinary Code That Kills a Taint Engine
param = decode(param) is as common as code gets. In a dataflow engine that resolves variables by looking backwards, it can recurse forever — and in Go the resulting stack overflow cannot be caught.
Reading an OWASP Benchmark Score Without Being Sold To
A tool that flags every test case scores 100% detection on the OWASP Benchmark. Recall is the number vendors quote and the one that means least — here is what the suite actually measures.
A Scanner's Scope Guard Belongs in Code, Not in a Config File
The difference between a security test and an unauthorised attack is permission on the target. If that boundary is a setting, then a typo, a redirect or a merged config is all it takes to cross it.
Never miss an update
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.