python-security
Safeguard articles tagged "python-security" — guides, analysis, and best practices for software supply chain and application security.
96 articles
Python Code Analysis: Tools and Techniques for Secure Code
How static and dynamic Python code analysis catches security bugs before they ship, from Bandit and Semgrep to dependency scanning and taint tracking.
Pickling in Python: A Security Guide
Pickling in Python serializes objects to bytes, but unpickling untrusted data can run arbitrary code. Here is how the risk works and how to defend against it.
Werkzeug in Python: What Developers Need to Know About Security
Werkzeug powers Flask and countless WSGI apps in Python. Here is how to use it without leaving the interactive debugger or hostname checks open to attackers.
Can a Code Corrector Actually Make Your Python Safer?
A code corrector fixes style and syntax, but it rarely catches the security bugs that matter. Here is where a Python code corrector helps, where it fails, and what to run alongside it.
How to Check Python Code for Security Issues: A Practical Guide
A working method to check Python code for security defects, from static analysis of your own source to scanning the third-party packages you pull in.
How to Validate a URL in Python Safely
A practical guide to validating URLs in Python without opening SSRF or injection holes — what the standard library gives you, where it fails, and how to build a safe validator.
Python tracemalloc: Finding Memory Leaks and Why It Matters for Security
How to use Python tracemalloc to trace memory allocations, hunt leaks, and understand why unbounded memory growth is a real availability risk.
Why Python's eval() Is Dangerous and What to Use Instead
Python eval() runs arbitrary code, and feeding it untrusted input is a remote code execution bug waiting to happen. Here's the risk, how the exploit works conceptually, and safer alternatives.
How to Use PyPI openpyxl Safely: Security Risks and Fixes
The openpyxl package on PyPI is safe for most workloads, but XML parsing and spreadsheet formula injection deserve attention. Here is what to watch for.
PyPI Account Recovery: A Security Model Review
Account recovery is where most identity systems leak security, and PyPI is no exception. A close look at how recovery works today, where the edges are, and what enterprise publishers should plan around.
Deserialization Attacks in Java and Python
Insecure deserialization turns data parsing into code execution. This guide covers deserialization attacks in Java and Python, the gadget chain concept, and practical defenses for both ecosystems.
PyPI Mandatory 2FA for Critical Packages: A Turning Point for Python Security
PyPI's decision to require two-factor authentication for critical package maintainers marks a significant step toward securing the Python supply chain.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.