The release of Python 3.14, released on October 7, 2025, marks a great milestone for the Python programming language. Developing a new release for the Python language is a major challenge and very hard work for many volunteers active in the Python ecosystem.
Python 3.14.0 contains many new features and optimisations compared to Python 3.13.
(more…)Python security is gaining attention due to the still rising usage of Python. Python applications are not immune to common security flaws. So, security testing, especially static application security testing (SAST) on Python code, is recommended for everyone who shares code.
(more…)Python is the most widely used programming language worldwide. Its clear syntax, extensive libraries, and adaptability make it suitable for beginners, researchers, and professionals alike. But security is a growing critical concern for Python code. AI-generated code — is not secure by default and human programmers are no security experts.
A fantastic built in function that can be used in Python is `exec`.
(more…)Python is the most widely used programming language worldwide. Consequently, many programs, even those built on top of FOSS Python modules, are freely available on The Python Package Index (PyPI.org).
Python security is gaining attention due to its rising usage. Python can be considered a secure language, yet Python applications are also susceptible to common security flaws. Researchers, especially security researchers, often exaggerate security risks.
AI generated summaries of scientific papers are often of very limited use.
(more…)Reading scientific cyber security literature is crucial for continuous development and learning. Engaging with research papers often leads to new insights or a deeper perspective on a subject.
The paper titled “PyPitfall: Dependency Chaos and Software Supply Chain Vulnerabilities in Python” (arXiv: 2507.18075) captured my attention. Authored in 2025 by researchers from the Computer Science Department at the New Jersey Institute of Technology.
(more…)In today’s digital world, security remains a critical concern. This applies equally to Python software. Security breaches that are possible when running untrusted Python programs are real.
This checklist is intended for anyone who wants to create Python programs that are secure by design.
Programming in Python is fun, but when you create programs for others, you SHOULD prevent introducing security weaknesses.
(more…)Python’s dominance as a programming language makes it a prime target for security risks. In today’s digital world, security isn’t guaranteed: a solid architecture helps, but even well-written code—including AI-generated code—is not secure by default.
The guiding principle for protecting your systems is simple: never trust, always verify (Zero Trust). Since cybersecurity is inherently complex and mistakes are inevitable, proactive verification is an indispensable safeguard.
(more…)Python is the most widely used programming language worldwide. Its clear syntax, extensive libraries, and adaptability make it suitable for beginners, researchers, and professionals alike. From powering leading websites to driving breakthroughs in artificial intelligence and data science, Python has become a foundational technology across both academia and industry.
But in today’s digital world, security remains a critical concern. This applies equally to Python software: preventing vulnerabilities starts with a solid architecture, but even well-written code — including AI-generated code — is not secure by default.
Validating Python code for potential vulnerabilities, using a SAST tool, is therefore essential, whether you are writing your own programs or relying on Python code developed by others.
Good Python SAST(Static Application Security Testing) tools aim to report all potential code weaknesses. However, not every weakness is a vulnerability that requires immediate remediation.
Whether a security weakness found by a SAST tool should be fixed is determined by evaluating three factors: Context, Cost, and Program Type.
Modern Python SAST scanners prioritize comprehensive coverage, flagging all possible code weaknesses for human review. From this perspective, the results aren’t “false positives,” but items requiring contextual assessment.
The ultimate decision to fix a reported weakness hinges on the program’s execution environment and business criticality. Since only the developer or user holds this complete contextual understanding, the responsibility for final security triage remains human. You are the authority. No AI tool can do your work!
SAST suppression features carry high security risk because the program’s usage and environment are subject to change.
For effective security auditing, the decision to ignore or defer a weakness must be transparently documented. The best practice is to place an explanatory comment directly in the code, as this guarantees the human reviewer—who performs the final security triage—will see the rationale in the immediate context of the flagged weakness.
A simple FOSS tool identify potential security risks in Python programs is Python Code Audit.
This static application security testing (SAST) tool streamlines and automates key security checks for Python code, helping Python users and developers to detect vulnerabilities early.
The rapid growth and increasing complexity of Python based web applications and systems have made robust security testing more important than ever.
Cybercriminals are constantly evolving their tactics, looking for vulnerabilities they can exploit to steal data or disrupt operations.
Static Application Security Testing (SAST) is a security methodology that analyzes an application’s source code and related artifacts (such as design documents) without executing the code.
For Python applications, specific Python SAST tools, like Python Code Audit, perform an in-depth, automated review of the source code to detect security weaknesses and potential vulnerabilities early in the development lifecycle.
(more…)Python’s popularity and accessibility make it an attractive target for malicious actors. Its widespread presence on developer and server machines means attackers often find it readily available for misuse.
A key security risk is Python’s ability to easily execute arbitrary code provided as data, which is a common mechanism in various injection and remote code execution (RCE) attacks.
(more…)