python
Safeguard articles tagged "python" — guides, analysis, and best practices for software supply chain and application security.
101 articles
How to Install Python on Mac Terminal: A Step-by-Step Guide
The clean way to install Python on a Mac using the terminal, why you should not touch the system Python, and how to keep your install secure and up to date.
CVE-2021-25288: Buffer overflow in Pillow FLI decoder
CVE-2021-25288 is a buffer overflow in Pillow's FLI decoder, fixed in Pillow 8.1.0. Here's what's affected, the risk profile, and how to remediate.
CVE-2023-30861: Flask session cookie disclosure to templates
CVE-2023-30861 lets caching proxies leak Flask session cookies between users when responses aren't marked Vary: Cookie. Here's who's affected and how to fix it.
PyPI Security News: How to Track and Respond to Python Package Threats
Keeping up with PyPI security news is now part of the job for any Python team. Here is how to follow the threats that matter and act before a malicious package reaches production.
Mocking in Python: unittest.mock, MagicMock, and Return Values
A practitioner's guide to Python unit test mocking: when to use Mock vs MagicMock, setting return values and side effects, patching in the right place, and the assertions that make a mock worth writing.
Why Python assert in Production Code Is a Security Risk
Using Python assert in production code is risky because assertions are stripped when Python runs optimized. Any security check written as an assert simply disappears.
Microsoft's durabletask PyPI Package Compromised (19 May 2026): A Linux Wiper and Multi-Cloud Credential Theft
On 19 May 2026, three malicious versions of Microsoft's durabletask PyPI package were uploaded in a 35-minute window. The payload steals AWS, Azure, GCP, and Kubernetes credentials in under four seconds and ships a locale-gated rm -rf wiper.
PyPI Malware Today: How Attacks Reach Your Builds Now
PyPI malware today mostly arrives through typosquatting, dependency confusion, and malicious install scripts. Here is how the current attack patterns work and how to defend your pipeline.
Python pptx: Using python-pptx Securely to Build Presentations
python pptx usually means the python-pptx library for reading and writing PowerPoint files. Here is how it works and the security pitfalls of processing untrusted decks.
zipp in Python: Why It Is in Your Dependency Tree
The python zipp package shows up in almost every Python environment without ever being asked for by name. Here is what it does, how it got there, and the one CVE against it.
Boto3 Security: Using the AWS SDK for Python Safely
Boto3 is the AWS SDK for Python, and how you configure its credentials, sessions, and version pinning decides how much of your AWS account you are putting at risk.
Python Pickle: Reading, Writing, and Why It Is a Security Risk
How to pickle an object in Python and read a pickle file back, and the reason the standard library itself warns you never to unpickle data you did not produce.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.