python-security
Safeguard articles tagged "python-security" — guides, analysis, and best practices for software supply chain and application security.
94 articles
Python tracemalloc: Finding Memory Leaks and Why It Matters for Security
How to use Python tracemalloc to trace memory allocations, hunt leaks, and understand why unbounded memory growth is a real availability risk.
Why Python's eval() Is Dangerous and What to Use Instead
Python eval() runs arbitrary code, and feeding it untrusted input is a remote code execution bug waiting to happen. Here's the risk, how the exploit works conceptually, and safer alternatives.
How to Use PyPI openpyxl Safely: Security Risks and Fixes
The openpyxl package on PyPI is safe for most workloads, but XML parsing and spreadsheet formula injection deserve attention. Here is what to watch for.
PyPI Malware in 2026: What Changed
PyPI malware today looks less like typosquats and more like AI-assisted campaigns that mimic legitimate maintainers — here's what shifted and how teams are catching it before install.
Python Security Explained
How Python's install-time code execution and open PyPI namespace fuel real supply chain attacks — and what actually reduces the risk.
The email-validator Python Library: Usage and Security Guide
How the email-validator Python package works, why regex-only validation is a trap, and the deliverability checks that quietly protect your signup flow.
What is PyPI Security
PyPI security stops typosquats, dependency confusion, and poisoned CI builds before pip install ever runs your code.
PyPI typosquatting and malicious Python packages targetin...
PyPI typosquatting lets attackers slip malicious Python packages into your build with one typo. Real attacks, why PyPI is exposed, and how to stay safe.
FastAPI and Pydantic dependency injection security pitfalls
FastAPI's Depends() and Pydantic's type validation look airtight but hide real bypass patterns — caching bugs, extra="allow" mass assignment, and leaked test overrides.
PyPI malware campaigns targeting machine learning and dat...
PyPI malware ML packages have hit PyTorch and Ultralytics YOLO via dependency confusion and CI/CD compromise. What happened, and how to defend your ML supply chain.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.