python-security

To fix unsafe subprocess usage in Python, replace `shell=True` with list-based argument calls and apply proper input quoting. This prevents shell injection risks by explicitly separating the command from untrusted arguments.

The yaml.load function is insecure because it allows arbitrary object instantiation, leading to code execution. The safe alternative is using safe_load equivalents to parse YAML without executing embedded Python objects.

Prevent SSRF and SQL injection in Python by applying defense-in-depth input validation before making external requests or database queries. Validate and sanitize all untrusted inputs to block malicious payloads and unauthorized service interactions.

The best way to audit a Python project for path traversal and deserialization vulnerabilities is to scan for unsafe file path concatenation and unsafe deserialization patterns. Replace them with validated path handling and secure loading functions.

Yes, this Python security guidance applies to projects of varying sizes, from small scripts to large web services. It provides explicit safe patterns and validation checks that secure untrusted input handling and external service interactions across any scale.