python
Safeguard articles tagged "python" — guides, analysis, and best practices for software supply chain and application security.
101 articles
Python Cython Extensions and the Supply Chain
Cython-built Python extensions ship as platform-specific binaries with a build toolchain behind them. That introduces supply chain surface most teams have not mapped.
Flask-CORS Security: The 2024 CVEs and How to Configure It Safely
Flask-CORS is easy to enable and easy to misconfigure. A look at the 2024 path-matching CVEs and the configuration mistakes that actually open your API.
How to Install Python on a Mac: The Clean, Safe Way
Yes, you can install Python on Mac OS in five minutes — but the difference between a clean setup and years of PATH pain is decided by which of the four install routes you pick first.
How to Run Python on Mac: A Step-by-Step Guide
macOS ships with Python, but you should not use it for your own projects. Here is how to run Python on a Mac the right way, from installing a real interpreter to isolating each project.
PyPI Trusted Publishing Token Leaks in 2025
Trusted Publishing made PyPI safer, but leaked short-lived OIDC tokens in CI logs kicked off a credential-replay campaign that PyPI, GitHub, and Sonatype all tracked in 2025.
AI Python Code Correctors: What They Catch and What They Miss
AI Python code correctors fix syntax and obvious bugs fast, but they miss the security and correctness issues that matter most. Here is where they help, where they fail, and how to use them safely.
Python Wheels vs Source Distributions: Security Implications
Installing an sdist runs someone else's code on your machine; installing a wheel doesn't. That one difference drives most PyPI malware — and most of the right defenses.
Signing Python Wheels in Production
PyPI supports attestations now. Here is how to actually sign Python wheels in a CI pipeline, verify them at install time, and deal with the rough edges.
SLSA Build Provenance for Python Publish
Python packages on PyPI can carry SLSA provenance via PEP 740. Here is the publish workflow, the verification story, and the parts that still do not quite fit together.
Python Package Typosquatting in 2024: Scale, Tactics, and Defenses
Typosquatting on PyPI reached industrial scale in 2024, with attackers using automated tooling to register thousands of malicious package names targeting common misspellings of popular libraries.
Pydantic v2 Security Implications
Pydantic v2 rewrote the core in Rust and changed validation semantics. Here is what that means for security-sensitive code, from input coercion to ReDoS exposure.
FastAPI Supply Chain Security: A Working Guide
FastAPI's dependency surface is deceptively large. Here is how to lock it down in practice, covering Starlette, Pydantic, Uvicorn, and the plugins you likely missed.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.