is python safe reddit - Brave Search

Is Python a Security Vulnerability?

reddit.com › r › Python › comments › 7eba55 › is_python_a_security_vulnerability

No, there is nothing inherently insecure about python. However Python can be used to make a vulnerability. For instance it would be easy to make a web portal that executes anything that is typed in. This is true for any programming language, but python makes it extra easy. And I know, you would know better, but IT departments see all their users as idiots (often with good reason). Answer from novel_yet_trivial on reddit.com

reddit.com › r/learnpython › potential security risks of using python at work

r/learnpython on Reddit: Potential Security Risks of using Python at Work

January 21, 2025 -

So I wanted to install Python, download Selenium library on it, and combine it with Webdriver to access web-driven accounting software to automate some stuff; mainly downloading reports from the accounting software since there are tones of reports to download every month, which the software does not have automation function for. I don't want to deal with any data.

Senior director and I went to IT for the request to download Python and they declined; they said there is a security risk.

Does anyone know what potential security risks they are referring to? I don't have cs background so I'm not very sure. And is there a way to mitigate those risks?

A few people have given plausible guesses, but the fact is we can't know how to answer this because we don't know where you work, what systems you're trying to install python and what the security requirements of those systems are. There are a million possible reasons the IT people responsible for security might not want a general-purpose programming environment on a given system. Unfortunately, you have to ask them which ones they are actually concerned about.

I feel like you should be asking your IT, not reddit. Regardless, you're using open source resources, if those get compromised, who will be responsible? It would be IT, because they were the ones to allow it. If your senior director is willing to sign some paperwork, placing all financial data breaches due to the use of your tool as their responsibility, then I'm certain IT would be more willing. My additional guess, is that your senior director will not sign such paperwork either.

reddit.com › r/python › is python a security vulnerability?

r/Python on Reddit: Is Python a Security Vulnerability?

November 20, 2017 -

I recently sent a request to my employer's IT department asking for access to Python 3.6.3. The request was denied with the justification "Python is dangerous to have on a pc. It is a useful attack vector."

Can anyone provide insight on what this might mean? Does simply having Python installed on your computer make you more susceptible to attacks? I can't tell if my employer has a valid concern here or if they are just taking the easy route.

EDIT: Spelling

No, there is nothing inherently insecure about python.

However Python can be used to make a vulnerability. For instance it would be easy to make a web portal that executes anything that is typed in. This is true for any programming language, but python makes it extra easy.

And I know, you would know better, but IT departments see all their users as idiots (often with good reason).

Every Macintosh and a lot of Linux distributions for desktop have Python installed by default. I don't think they are unsafe.

Videos

Python Security Best Practices Explained (2026 Guide) - YouTube

January 5, 2026

What Are Common Python Security Pitfalls? - Next LVL Programming ...

August 25, 2025

Who's Keeping the Python Ecosystem Safe?

Secure Coding Guide for Python - David Mather & Bart Karas, Ericsson ...

October 1, 2024

Why Python apps are becoming less secure - YouTube

reddit.com › r/learnpython › what does a secure python installation look like?

r/learnpython on Reddit: What does a secure Python installation look like?

April 20, 2025 -

Python's great, everyone cheers on Python, every weird essential desktop application at the office relies on a Python install, every analyst who has hit the limits of Excel wants to use Python. I don't see anyone really talking about the security implications of having a modular scripting stack with a history of add-on compromise installed on every production workstation.

How do you secure a Python install, what do you allow in it, and how do you cope with the eleventy hundred Python modules users claim they need?

Virtual environments. Plus malware isint made in Python rarely because of the fact having to rely on the user to have Python to begin with. The packages having malware is different story. Though that’s a risk with everything.

This question is probably better answered at r/cybersecurity But I'll throw in my 2 cents. Every program regardless if it's python or not comes with a large amount of dependencies and moving parts, some of them open source, some of them are hell knows from where. Look at xz security mess as an example. https://www.akamai.com/blog/security-research/critical-linux-backdoor-xz-utils-discovered-what-to-know Also at solarwinds. https://www.fortinet.com/resources/cyberglossary/solarwinds-cyber-attack You can have better control if you use a local repository with hand selected packages. Then developers will need to request more packages, or make due with popular vetted ones...

reddit.com › r/learnpython › making sure python packages are safe

r/learnpython on Reddit: Making Sure Python Packages are Safe

May 23, 2020 -

Hi,

I've been learning Python pretty well over the past few months, and I feel like I know enough now to know that I know nothing :D I've been looking around Github and PyPI for some cool packages, and it makes me raise the question:

How do we know if a given package is secure and doesn't contain any sort of malware? I mean, besides going through and inspecting every line of code by hand.

Thanks in advance.

Also, this is my first question on Reddit, so forgive me if it's a stupid question :D

Same as any other software on the internet. You either go though it line by line yourself, or trust that someone else has. For big, popular software packages there are lots of people that review them so you are probably pretty safe.

Theres a pretty big open source project called bandit. You can use bandit to scan code for vulnerabilities, it points out common vulnerabilities that lead to malware payloads injection. It's not perfect but I have found it useful.

reddit.com › r/learnpython › is python safe for sensitive data?

Is Python Safe For Sensitive Data? : r/learnpython

May 28, 2019 - My understanding is that Python modules are installed on the computer and unless there is existing hostile code in the functions in those modules, there is no access to the Internet unless my code specifies, and no one can access that sensitive data · Since they're bundled into the executable, you can (and should) read the library code to ensure that there is no malicious code in them. That doesn't mean they are safe - still got bugs to worry about - but it's far better than having users install packages directly from pip.

reddit.com › r/webdev › how to convince it department that python is relatively safe to use on work computer?

r/webdev on Reddit: How to convince IT Department that Python is relatively safe to use on work computer?

April 25, 2020 - PwC, a global auditing firm, uses Python. If it's safe for the auditors, it's safe for you. Someone else mentioned that it's probably because someone is loyal to Microsoft, and this rings true to me.

reddit.com › r/asknetsec › is python secure to use for data analysis?

r/AskNetsec on Reddit: Is Python secure to use for data analysis?

February 12, 2021 -

Is Python a secure platform for performing data analysis on a company-wide ethernet dataserver? The words "free and open source" scare some people into thinking anybody at all will access our data if we use Python to analyze it. I'm fairly certain the answer is "yes."

Python is just a language not a platform. That's akin to asking if screw drivers are secure enough to build a prison.

It is a programming language, if you write unsecure code then yes people without the correct access could access it. The python interpreter by its self is secure and patched regularly if things are found.

reddit.com › r/learnpython › how do you insure a python library is safe/legit?

r/learnpython on Reddit: How do you insure a Python Library is safe/legit?

July 14, 2020 -

Since a Python Library is essentially a chunk of code written from someone else. How do we know it's "safe"/"legit"?

Are there laws concerning this? Or do we have to test this on our own as a developer? Is it even "testable"?

Not a real answer, but if the library is open source you could look at the code and make sure that it does what you think it does. I usually just use popular libraries and assume that they’re legit based on popular opinion.

There's almost no recourse if someone has malware in their PyPi project and you install it, because it is incredibly difficult to follow up when the authors are anonymous and probably in another country. You either have to trust it, or read the source code yourself, or (as many companies do) don't use any public packages just to be safe. There have been cases where an author adds malicious code later on . So it is buyer beware. It's generally pretty safe though, malware is pretty rare. The exception would be C extensions and foreign interfaces, which are not so easy to audit. So if you are a major software company, you might want to avoid using public packages as a rule, unless they are like, by Google, or a trusted source, but never small helper packages. That said, it is easy to read the source code, and any popular package will have a lot of eyes looking at the source code, and it would be really tough to sneak in any malicious code and have the pull request accepted.

Find elsewhere

Google Bing Mojeek

reddit.com › r/python › fake python website be carefull!!!

r/Python on Reddit: Fake python website Be carefull!!!

February 5, 2023 -

Don't get fooled They're looking very similar

Whois points registar to RU. https://whois.domaintools.com/pythonsource.tech - reported to the fraud agencies.

VirusTotal link of the zip file: https://www.virustotal.com/gui/url/e57adbc898e9c23f974a49d205b334f6d9dfbfe25d4cf89f23ba7eed80a43c06/detection

reddit.com › r/learnpython › is there a trusted source/list of safe python packages?

r/learnpython on Reddit: Is there a trusted source/list of safe python packages?

July 26, 2023 -

Pypi doesn't do any vetting to packages published. Is there a list of packages that are known to be safe and verified by some org dedicated to checking?

You've asked a super important question. I've been lead on security projects and audited in this way. It's a fucking horrible process. Other than keeping a known, saved, local copy of any particular package, its a real challenge.

https://snyk.io/advisor/python

reddit.com › r/dataanalysis › why is python a security risk?

r/dataanalysis on Reddit: Why is python a security risk?

May 6, 2023 -

To keep it short, I monitor the performance of the tech products that is deployed around the country for my company. I got tired of using sheets and thought about creating a custom dashboard through python(local app first, then add it to our main Backoffice for everyone to see). Mid way through, I read a comment under a similar project saying that python has security risks but didn’t specify how or why. This has me concerned and makes me want to throw away the project since this will deal with very sensitive data. Is this true? If so, how can I work around this security risk?

Other option is my company is debating on getting Looker premium which would be easier and less of a headache but I’m an intern and I feel like this would not be effective experience to put on my resume. Thoughts?

We use Python very extensively (and R) in a financial environment. There were some issues with 3.10 that forced us to upgrade to 3.11, but I’m not aware of any internet security risks that wouldn’t also impact other tools. Interested to see responses.

reddit.com › r/learnpython › how safe are pypi packages?

r/learnpython on Reddit: How safe are PyPi packages?

February 23, 2024 -

New to Python and really enjoying learning the language, probably the most enjoyable human readable language.

Are the packages in the PyPi packages always safe?

For example when installing packages from Debian they are signed etc. they might not work but are what they say they are. On a scale of ‘always check the code’ to ‘yolo it’ll be fine’ would you rate PyPi?

Reputation is everything. I have no problem using pip to grab the popular requests or selenium or pandas, but branching out too far you're bound to find malware or malicious code. You can even install them on accident with a typo (pip install selnium), they're eventually caught and get removed from PyPi but still be wary of it. Just google "pypi malware" and you'll see stories. To sum it up, be careful and know what you're installing. If you find a new library you want to use, go to its git and check out the code and reputation there.

Last year I stumbled upon a PyPi package that was one typo away from a popular data science library. After digging into the typo package it was clearly fake and potentially malicious, it had functions to write some cpp program that opened network connections to disk - I didn't see a way to compile and run said cpp program, but still. The same PyPi uploader had more one-typo-away fake data science libraries. I reported the whole thing to PyPi and they took everything down almost instantly, a matter of minutes. So be careful with those typos.

reddit.com › r/learnpython › how safe it is to install a python project from github?

r/learnpython on Reddit: How safe it is to install a python project from GitHub?

July 8, 2022 -

I am considering installing a project that I found on Github:

https://github.com/stevedsun/notion-graph-view

(it is a really small project for the number of lines of code that it has)

The project has 133 stars

It's about creating a graph view from the content of the app Notion using its API to pass the information that the "graph app" needs/

But how safe is that? does the information that the "graph app" takes, stays on my PC?

Generally-speaking, a public repository doesn’t mean there isn’t some function or feature that exposes you in some way. If you’re ever unsure, don’t use it. That said, it generally also means that you can explore the code and its requirements yourself, to ensure that you’re comfortable with what’s going on. Watch for things like requests to unfamiliar servers, access granted for things you don’t expect, or third-party libraries that you’ve never heard of. If it’s worth your time coding something, it’s worth the time reading the various docs and files to make sure your work is secure and safe!

So here’s the thing: GitHub is only a repository. The repo you’ve linked is ‘open’ for all to see. Hence “open source.” This doesn’t mean that it’s 100% safe, just that you can read the code. But see, that’s the idea in open source code. You take full responsibility in reading and understanding what the code does. There’s a lot of assumptions in the community that open-source means safe. It does not. It only means “caveat emptor” (buyer beware). Do yourself a favor and do some research to form an opinion based on what what you can understand. That said, while I do not understand the code fully, I can see that it’s asking to code a token directly. This is common, but bear in mind that there are better ways to handle this that are more advanced and complex. More complicated than I can write about while replying on my phone to you.

reddit.com › r/learnpython › will downloading python mess up my os

r/learnpython on Reddit: Will downloading python mess up my os

September 19, 2024 -

Hey everyone so I brought a book teaching to programme in python for absolute beginners and it says you have to download python 3 but also warns that windows os systems can get glitchy and confused by it. I have windows 11 and just got the computer a few months ago so was wondering if it was safe to download without messing my computer up? I'm totally new to programming so sorry if this is a stupid question

You'll be fine, sounds like a crappy book.

Python is a user space program like any other. It can't mess up your computer unless you make it do that.

reddit.com › r/learnpython › python, pip, and it security

r/learnpython on Reddit: Python, pip, and IT security

May 7, 2023 -

A big issue I've heard of about pip is that it's insecure. Packages have been found to be malware, often using spelling errors as an avenue of attack.

If a company is concerned about security, then what is to be done? Are there more secure python installations available?

Python is often used by engineers & scientists to "Automate the Boring Stuff". Fine and dandy, but we won't be able to use Python if it's a security risk.

In practice, this isn't nearly as big of a problem as it might initially seem. At least not in my opinion. pip isn't insecure, it's just a tool that accesses PyPI (Python Package Index) and downloads stuff from there. You can tell pip to use an alternative package repository - at a previous job all packages were installed from a company controlled mirror built with Artifactory. PyPI has some malicious packages, yes, but the problem is shared with NPM, crates.io (Cargo), and many others. And while spelling errors causing malicious packages taking over sounds scary, we need to remember that project dependencies don't change often. As long as you write the name right the first time, it's not going to suddenly change on its own. The only attack vector that may actually hurt a careful developer is if someone manages to hijack an existing package and pushes a change that makes it malicious, but these are rare occurrences as it requires the bad actor to gain access to the package owner's PyPI account. Most package maintainers (including myself) use password managers with long passwords for this reason. And the way you guard against this is by not using the bleeding edge unless necessary (but since the risks are small in the first place I wouldn't worry unless you were handling state secrets). TL;DR, don't worry too much. If you want to, you can always host your own Artifactory instance.

You can have a local mirror/server that contains only packages you've manually checked and approved, and block the global pip server.

reddit.com › r/python › psa: bootleg `python.org` spotted in the wild

r/Python on Reddit: PSA: Bootleg `python.org` spotted in the wild

March 1, 2023 -

Just came across a clone of the Python website. Flagging so y'all keep your eyes peeled for them camouflaged rattlesnakes.

As a security researcher, whenever you see a phishing site like that, report it to the domain registrar thats managing that domain. You can look up the registrar by using any WhoIs tool. Look for an abuse email. Not all registrars have it but most do. I usually use https://whois.domaintools.com In this case the registrar is Alibaba Cloud Computing. And it looks like it was registered in August of 2022. Alibaba Cloud Computing doesn’t have an abuse email listed, but if you google Alibaba Cloud Computing Abuse Form, you’ll find the form to fill out for it. Usually registrars work pretty fast. Some within hours and others within a couple of days. Then they will revoke the domain name and usually ban the account or something along those lines. Its not perfect. But any downtime for the bad guys is a good thing. Its very interesting to me that they are replicating the Python site. I’d love for someone with malware expertise to analyze the binaries to see if they were modified and contain any viruses.

Sometimes I wonder, how you guys even stumble upon such sites? I've never seen anything but official sites but I don't use google services

quora.com › Is-Python-safe-for-my-computer

Is Python safe for my computer? - Quora

Answer (1 of 6): Considering Python is in regular use across tens of thousands of computer systems across the world; everything from desktop machines, to internet servers, to small devices on the Internet of Things. There is no reason to suspect that Python is any less safe than any other softwa...

reddit.com › r/learnpython › advice on staying secure with pip installs

r/learnpython on Reddit: Advice on staying secure with pip installs

November 12, 2025 -

I am just wondering what are some general tips for staying secure when installing packages via pip. I am concerned there could be malware given all package managers like npm, composer and pip have that issue from time to time.

I would usually gauge a packages trust level via its downloads which I cannot view on pypi.

Thanks

https://pypi.org/project/pip-audit/ Also, use popular and well-maintaned packages - perhaps check their GitHub pages for statistics?

First thing, make sure you are using virtual environments. That won't necessarily protect you from malware attacks, but makes it easier to manage your installed packages. Second, make sure you have the right package name, as there are a lot of similarly names packages; that's how a lot of those malware attacks happen. Check the package info on pypi.org. There should a link to the GitHub repo in most cases. If the repo has a lot of activity, probably safe, as any attack is likely to be caught. If Pypi says it doesn't have a current maintainer and there has only been one update in the last three years, and you can't tell what it did based on the commit comments and a code diff, maybe be more concerned.

reddit.com › r/python › pypi packages safe?

r/Python on Reddit: PyPi Packages safe?

October 29, 2014 -

Are all PyPi packages safe to use? Like do they contain any malware or anything like that?

They are not safe. It would be easy to upload malicious code to PyPI. Interesting reading at http://www.davidfischer.name/2012/05/signing-and-verifying-python-packages-with-pgp/

There is nothing stopping a package maintainer from putting malware in their library. PyPI code isn't audited. But there's never been an incidence of that happening that I've heard of (on pypi or cpan or rubygems). There are far easier ways to get malware out there. Any package of note on pypi is going to have enough eyes on it that it's likely to be noticed before too long and then that maintainer would be blacklisted. It just doesn't make sense for someone to have the motivation to put malicious code into a package. Python is an interpreted language, so unless it's a packaged with C extensions in a compiled binary format, you can look at the source code yourself and re-assure yourself that way. I skim through packages all the time, not because I've got any worries about security, but I like to see the lay of the land of a packages I'm depending on.

reddit.com › r/learnpython › why is python marked as a virus

r/learnpython on Reddit: why is python marked as a virus

March 30, 2024 -

I downloaded Python from Python.org and I open the file and it says its a virus.

Can someone tell me what is going on

Check the hash from your download. If the hash matches, I would disregard the warning. AV's can send false positives. Make sure you are downloading from the official website . If you are downloading Python 3.11.8, this is the web page where you can find the hash files.

This sounds very weird. What exact python version did you download? Can you post here the download link? Also what is your Antivirus program? and what virus does it say it is?