Security
Python’s package index has been the target of supply chain attacks for years. The handbook covers the modern defenses — Trusted Publishing, digital attestations, hash pinning, vulnerability scanning, and lint rules that catch unsafe code patterns.
Supply chain defense
Scan and lint
More Security pages
Everything else tagged security, grouped by section. Pages featured above are not repeated here.
How To
From the blog
Posts tagged security.
-
Astral told you how they secure uv. Here's what to keep.
Astral published a detailed writeup of how they secure their org. Most of it is team-scale GitHub policy. Four things translate directly to a solo Python maintainer.
-
PyPI's Second Audit Found 14 Bugs. Two Remain.
Trail of Bits audited PyPI. Twelve issues were patched, two accepted. The accepted ones tell you more about PyPI than the twelve that were fixed.
-
LLM-Powered Copycats Are Flooding PyPI
A developer published his first PyPI package. Within hours, three AI-generated clones appeared. The pattern is spreading, and it's a supply chain risk.
-
LiteLLM Got Owned, and Your Dependencies Might Be Next
A supply chain attack hit litellm on PyPI, stealing credentials and deploying backdoors. Bernát Gábor's guide shows how to defend against exactly this kind of threat.
-
Pydantic Monty: A Secure Python Interpreter for AI Agents
Pydantic's Monty is a minimal Rust-based Python interpreter for safely executing LLM-generated code without containers.
-
Dependabot Now Supports uv
GitHub's Dependabot now officially supports uv for automated dependency version updates and security monitoring.