The security of modern Python software relies heavily on static code analysis tools. Python Code Audit uses at its core the Python AST to detect possible code weaknesses. Not all weaknesses can lead to vulnerabilities, so context knowledge is always the critical needed human factor. But knowing different methods to detect weaknesses in Python code and tools available, asking yourself what method is better is a good question.
(more…)Author: Maikel Mardjan
-
How to Run Untrusted Python Code Without Getting Hacked
Running third-party or unknown Python code is one of the fastest ways to introduce serious risk onto your system. A single malicious package, a compromised dependency, or a script that quietly escalates privileges can lead to data loss, credential theft, or full system compromise.
(more…) -
Secure CSV Handling in Python: A Practical Guide
CSV (Comma-Separated Values) remains the most common format for exchanging data with spreadsheets and databases. Because Python is one of the most widely used languages for data work, using CSV files is or should be a real security concern.
(more…) -
Defusing XML bombs and other exploits
I love good, simple Python libraries that improve security in a simple, straightforward way. The ideal solution is a well-designed module that has minimal external dependencies and meets key criteria on my checklist for Python Security Applications.
(more…) -
Security by Design: The Practical Alternative to Tool Overload
No business is too small to be a target for cybercriminals. Small and medium-sized businesses (SMBs) are attractive prospects for ransomware. They often have limited resources for security management and have outsourced every aspect of IT. It makes little difference whether that outsourcing is very expensive or the cheapest option available. SMBs also hold valuable customer data, and people remain the weakest link.
(more…) -
What the Halting Problem Means for Python Security
Python code plays a central role in modern computing, yet Python applications are not immune to cybersecurity threats. Consequently, security has become a critical concern for both users and developers alike.
But cybersecurity is never black or white. It is all about context. Being precise about definitions is key. A security weakness is not the same as a vulnerability. It always depends.
(more…) -
Simplicity by Design: Why Python Code Audit Favours Plain HTML Reporting
Python plays a central role in modern computing, yet Python applications are not immune to cybersecurity threats. As a result, security has become a critical concern for developers and users alike.
(more…) -
Rethinking Python Asserts in SAST: Insights from T-DOSE 2026
Recently I was at the great FOSS conference T-DOSE to learn new tech things and meet great open-minded people. After my talk about Python Code Audit. I had a very interesting discussion about the Python assert statement with some very smart security friends.
(more…) -
Simplifying the Stack: Start Security Testing in the Browser
Cyber security disasters still happen every day. Being security-aware is crucial, but it is not enough. So never trust, always verify!
To make security validation simple, testing applications before use is a must. However, a huge drawback is the difficulty of setting up even a few simple tests.
(more…) -
Security By Design: The Shortcut to Smarter, Safer Systems
No business is too small to attract cybercriminals. In fact, small and medium-sized businesses (SMBs) are often more appealing targets for ransomware than large, established enterprises. Limited resources, combined with access to valuable customer data, make them particularly vulnerable.
(more…)