security-checklist

To prevent SQL injection and path traversal in Python code reviews, enforce parameterized SQL queries, apply input validation, and implement path traversal guards for file I/O operations. This stops injection attacks and unauthorized file access during CI pre-merge checks.

The best way to manage API keys and secrets in Python applications is enforcing environment-based secret management. Keep credentials entirely out of source code by using environment variables or dedicated secret stores to prevent accidental exposure.

To secure file uploads and network requests in Python, enforce strict upload type and size limits, validate uploaded files, and configure safe HTTP requests with SSL verification and explicit timeouts to prevent unauthorized access and hanging connections.

You should avoid eval and exec in Python code because they allow remote code execution through user-supplied input. Check for them during code reviews to ensure dynamic execution is eliminated and safe input validation patterns are applied instead.

Yes, this security checklist can be used for auditing Python API integrations and login flows. It specifically targets authentication implementations and external API integrations to identify improper secret handling and injection vulnerabilities.