Security

Listed by section, in editorial order. Click a column header to re-sort the whole list.

Press / to search. Tags open their category. Click a row for details.

Search and filter

Results

Row number Tags

Cryptography 4 projects

Don't touch a Python cryptography library's raw ciphers: encrypt with cryptography's Fernet or PyNaCl. Paramiko runs SSH, and ItsDangerous signs tokens.

A package designed to expose cryptographic primitives and recipes to Python developers.
pyca/github.com/pyca/cryptography /7,834 stars /
Python binding to libsodium, a fork of the Networking and Cryptography (NaCl) library.
pyca/github.com/pyca/pynacl /1,209 stars /
The leading native Python SSHv2 protocol library.
paramiko/github.com/paramiko/paramiko /9,888 stars /
Safely pass trusted data to untrusted environments and back.
pallets/github.com/pallets/itsdangerous /3,141 stars /

Penetration Testing 5 projects

With permission to test a web app, intercept its traffic in mitmproxy and test its inputs for SQL injection with sqlmap: two Python penetration testing tools.

An interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers.
mitmproxy/github.com/mitmproxy/mitmproxy /46,476 stars /
A collection of Python classes for working with network protocols, widely used for Windows and Active Directory testing.
fortra/github.com/fortra/impacket /16,205 stars /
Automatic SQL injection and database takeover tool.
A CTF framework and exploit development library.
Gallopsled/github.com/Gallopsled/pwntools /13,800 stars /
Hunt down social media accounts by username across social networks.

Supply Chain Security 3 projects

Audit your dependencies for known vulnerabilities as part of Python supply chain security. A uv project has uv audit built in; other projects run pip-audit.

Audits Python environments and dependency trees for known vulnerabilities, using the Python Packaging Advisory Database or OSV.
pypa/github.com/pypa/pip-audit /1,388 stars /
(part of uv) uv's dependency vulnerability scanning backed by OSV.
astral-sh/github.com/astral-sh/uv /91,340 stars /
Finds leaked secrets in git history, directories, and files, from the original author of gitleaks.

Web Security 2 projects

Sanitize HTML your users write with nh3, then add a Python web security library for response headers. secure sets CSP and HSTS once for the whole app.

Python binding to the ammonia HTML sanitizer, a fast replacement for bleach.
messense/github.com/messense/nh3 /404 stars /
HTTP security headers for Python web applications with ASGI and WSGI middleware.
TypeError/github.com/TypeError/secure /1,074 stars /

Know a project that belongs here?

Tell us what it does and why it stands out.