Running third-party or unknown Python code is one of the fastest ways to introduce serious risk onto your system. A single malicious package, a compromised dependency, or a script that quietly escalates privileges can lead to data loss, credential theft, or full system compromise.
This cheat sheet gives you a practical checklist of the must-do and should-do actions before you install or execute any Python program.
Follow these steps reduces your exposure to supply-chain attacks, privilege escalation, and unintended data leakage.
Important: This is only a quick-reference summary. More crucial information like threat models, secure coding patterns, tooling recommendations, and detailed guidelines is available in Python Security Handbook.
Python Security Cheat Sheet
Securely Using a Python Program • Key principles before running unknown / third-party code
Python Security! MUST DO
Trusted Sources Only
Install only from official repos: PyPI, conda, conda-forge. Never from random sites/forums. Understand the code & origin before running.
Basic SAST Check
Scan with a well-maintained open-source Python SAST tool before execution. Avoid code that raises unexplained warnings.
Always Use Virtual Environments
Run inside venv / conda. Isolate from system. Never run as Administrator / root.
Careful with Dependencies
Prefer packages installable via pip/conda only. Avoid manual system-library installs unless inside a VM, container, or jail.
Isolation for Higher Risk
Python is not a sandbox. Use VM / container. Limit CPU, network, storage, file access. No access to system folders, USB, or cloud.
Prefer FOSS
Choose free & open-source (incl. dependencies). Source availability enables independent audit. Avoid closed-source / mystery scripts.
Author Security Validation
Look for a Python Code Audit Badge (or similar). Ask: Which SAST tool? Can they share a report?
Keep Everything Updated
pip list --outdated → pip install --upgrade. Only update from trusted repositories.
Have a Recovery Plan
Back up important data before running new code. If anything looks suspicious → disconnect from the network immediately.
+ COULD DO (extra certainty)
Avoid Closed External APIs / Cloud
Distrust programs relying on unverifiable external services or third-party auth.
No Telemetry / Tracking
Skip tools that collect usage data without full transparency — privacy & risk concerns.
Validate Dependencies
Check packages for known vulnerabilities. SBOMs raise awareness but do not guarantee safety.
Actively Maintained
Check last commit, open issues / PRs. At least yearly functional validation expected.
Responsible Security Policy
Look for security.md / security.txt. Private reporting channel required. Never report vulns publicly before a fix.
⚡ QUICK COMMANDS
Do a safe Online Audit of a PyPI package!
python -m venv .venv && source .venv/bin/activate
pip install <pkg> # only from trusted index
pip list --outdated
pip install --upgrade <pkg>
Install and use Python Code Audit:
pip install -U codeaudit
Security is never black and white. Help with improving Python Code Audit and its documentation, and make Python security more accessible for everyone.
Join the community and help build the most complete, local-first Python security audit scanner.