Skip to content

Security

Python’s package index has been the target of supply chain attacks for years. The handbook covers the modern defenses — Trusted Publishing, digital attestations, hash pinning, vulnerability scanning, and lint rules that catch unsafe code patterns.

Supply chain defense

Trusted Publishing
Publish without long-lived API tokens
Digital attestations
Sign wheels with PEP 740 attestations
Protect against supply chain attacks
Defenses uv enables

Scan and lint

Scan for vulnerabilities
Find CVEs in your dependencies
Ruff security rules
Catch unsafe code patterns
Why Trusted Publishing
The case for tokenless publishing

More Security pages

Everything else tagged security, grouped by section. Pages featured above are not repeated here.

How To

How to Host Your Own Python Package Index

Host private or mirrored Python packages. Choose between devpi, pypiserver, or bandersnatch for your network.

How to Ignore a Dependency in Dependabot Without Blocking Its Security Updates

Scope a Dependabot ignore rule to version updates so a pinned package stops routine PRs but still gets security fixes.

How to Keep a Capped Dependency from Blocking Dependabot Security Updates

Drop or raise a version ceiling in pyproject.toml so Dependabot can open security PRs instead of failing silently.

How to Manage Environment Variables in a Python Project

Store secrets in a .env file, load them with uv run --env-file or python-dotenv, and keep them out of version control.

How to pin GitHub Actions by SHA for Python projects

Pin GitHub Actions to commit SHAs instead of mutable tags to protect your Python CI from supply-chain attacks.

How to upgrade setup-uv from v7 to v8

Migrate astral-sh/setup-uv from v7 to v8 in GitHub Actions, with SHA pinning for supply-chain security.

How to Use `--exclude-newer` for Reproducible Python Environments

Set uv's --exclude-newer to a date or a duration to rebuild an old environment exactly or keep brand-new releases out of a resolution.

How to Verify Dependencies with Hashes in uv

Verify uv dependencies with SHA-256 hashes. Detect tampering and cache corruption at install time to block compromised packages.

How to Vet a Python Package Before Installing It

Vet Python packages with a checklist: download trends, source verification, and reputation tools. Catch supply chain risks before they happen.

Explanation

What is a Dependency Cooldown?

A dependency cooldown ignores package versions published in the last few days, so malicious releases get caught before they reach your environment.

What Is a Python Supply Chain Attack?

Python supply chain attacks reach through packages, maintainer accounts, builds, or PyPI. Map attack categories to defenses.

What is PEP 541 (Package Index Name Retention)?

PEP 541 defines how PyPI reassigns an abandoned project name to a new owner, and the protections that stop a name being taken from a reachable maintainer.

What is PEP 740?

PEP 740 defines modern Python package version schemes. How to use post-releases, dev versions, and local identifiers.

What is PEP 829?

PEP 829 closes the .pth import-line surface by splitting into two files: .pth for sys.path, .start for package startup entry points.

What is PyPI (Python Package Index)?

PyPI is the official Python Package Index where developers publish and discover installable packages, installable via pip, uv, and other tools.

Why Installing a Python Package Can Run Code

Python packages run code at install time, import time, and startup via .pth files. Supply chain attack surfaces and defense strategies.

Why pylock.toml Includes Digital Attestations

pylock.toml attestations prove who published each package. Detect supply chain compromises during code review.

From the blog

Posts tagged security.

Last updated on