python-security

Follow the nine-step security review workflow: scan for critical prohibitions like eval and pickle, check input validation at entry points, verify authentication and authorization, trace sensitive data handling, audit dependencies with pip-audit, and run bandit and semgrep for static analysis.

Use bandit for Python-specific static analysis, semgrep with p/python and p/owasp-top-ten rulesets for pattern matching, pip-audit or safety for dependency vulnerabilities, and detect-secrets for finding leaked credentials in the codebase.

Always use parameterized queries such as cursor.execute with parameter tuples, or ORM query builders. Never format user input into SQL strings with f-strings or percent formatting, and audit any uses of raw(), extra(), or RawSQL() in Django.

Yes. The references include framework-specific guidance: Django security settings and ORM safety, Flask session configuration and CSRF protection with flask-wtf, and FastAPI dependency-injection auth, CORS configuration, and rate limiting with slowapi.

pickle.loads on untrusted data allows arbitrary code execution because pickled objects can invoke arbitrary Python callables during deserialization. Use json.loads for data interchange or yaml.safe_load for YAML, and validate structured input with Pydantic models.

Static analysis tools like bandit detect known patterns but miss business logic flaws, insecure design issues, and runtime misconfigurations. Combine them with manual code review, dependency audits, negative security tests, and the provided architecture and deployment checklists.