Security

Listed by section, in editorial order. Click a column to re-sort the whole list.

Press / to search. Tap a tag to filter. Click any row for details.

Search and filter

Results

Row number Tags

Cryptography 4 projects

Don't touch a Python cryptography library's raw ciphers: encrypt with cryptography's Fernet or PyNaCl. Paramiko runs SSH, and ItsDangerous signs tokens.

A package designed to expose cryptographic primitives and recipes to Python developers.
pyca/github.com/pyca/cryptography / /1,113,017,827 downloads/month
Python binding to libsodium, a fork of the Networking and Cryptography (NaCl) library.
pyca/github.com/pyca/pynacl / /167,049,536 downloads/month
The leading native Python SSHv2 protocol library.
paramiko/github.com/paramiko/paramiko / /106,312,865 downloads/month
Safely pass trusted data to untrusted environments and back.
pallets/github.com/pallets/itsdangerous / /170,805,437 downloads/month

Penetration Testing 5 projects

With permission to test a web app, intercept its traffic in mitmproxy and test its inputs for SQL injection with sqlmap: two Python penetration testing tools.

An interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers.
mitmproxy/github.com/mitmproxy/mitmproxy / /4,410,728 downloads/month
A collection of Python classes for working with network protocols, widely used for Windows and Active Directory testing.
fortra/github.com/fortra/impacket / /539,893 downloads/month
Automatic SQL injection and database takeover tool.
sqlmapproject/github.com/sqlmapproject/sqlmap / /43,849 downloads/month
A CTF framework and exploit development library.
Gallopsled/github.com/Gallopsled/pwntools / /323,101 downloads/month
Hunt down social media accounts by username across social networks.
sherlock-project/github.com/sherlock-project/sherlock / /67,631 downloads/month

Supply Chain Security 2 projects

Audit your dependencies for known vulnerabilities as part of Python supply chain security. A uv project has uv audit built in; other projects run pip-audit.

Audits Python environments and dependency trees for known vulnerabilities, using the Python Packaging Advisory Database or OSV.
pypa/github.com/pypa/pip-audit / /27,989,572 downloads/month
(part of uv) uv's dependency vulnerability scanning backed by OSV.

Web Security 2 projects

Sanitize HTML your users write with nh3, then add a Python web security library for response headers. secure sets CSP and HSTS once for the whole app.

Python binding to the ammonia HTML sanitizer, a fast replacement for bleach.
messense/github.com/messense/nh3 / /35,681,274 downloads/month
HTTP security headers for Python web applications with ASGI and WSGI middleware.
TypeError/github.com/TypeError/secure / /2,265,572 downloads/month

Know a project that belongs here?

Tell us what it does and why it stands out.