Posts Tagged: devsecops
-
Auditing Flask 3.0 Dependencies for OWASP Top 10 Vulnerabilities
Audit Flask 3.0 dependencies for OWASP Top 10 A06 vulnerabilities using pip-audit, poetry audit, and safety CLI. Covers detection, fixes, and CI/CD integration for Werkzeug, Jinja2, and other deps.
-
Detecting Malicious PyPI Packages: Typosquatting Attacks on requests, urllib3, and pillow
Detect typosquatting PyPI packages mimicking requests urllib3 pillow: low downloads, suspicious uploaders, few versions. Python supply chain security script queries PyPI API/stats, flags risks. Prevent supply-chain attacks – actionable audit steps, CI integration.
-
How to Fix Vulnerable Dependency Errors in requirements.txt for PCI DSS Compliance
PCI DSS compliance Python: Fix vulnerable dependencies in requirements.txt. Step-by-step guide using pip-audit, safety CLI, pip-tools/uv locking. Quarterly scans, exact pinning, hashes for Req 6.2.3 audits. Pass vulnerability scans – requirements.txt security best practices 2026.
-
Poetry audit vs pip-audit vs safety: PyPI Vulnerability Coverage Comparison
We compare poetry audit, pip-audit, and safety CLI across vulnerability detection coverage, speed, data sources, output formats, and CI integration. Benchmarks on Flask, Django, and FastAPI projects reveal trade-offs for different workflows.
-
Running pip-audit in CI/CD: Failing Builds on Critical and High Severity Vulnerabilities
Integrate pip-audit into GitHub Actions, GitLab CI, and Jenkins: fail builds on critical and high severity vulnerabilities only. Scripts for JSON severity filtering, ignore rules. Secure Python dependencies in CI/CD pipelines.
-
Securing Your Python Supply Chain: Scanning poetry.lock for Compromised Maintainers
A script to check poetry.lock files for packages maintained by known compromised PyPI accounts. Queries PyPI API and cross-references a curated list; suitable for CI/CD integration.
-
Security & Vulnerabilities (CVEs, pip-audit, safety): Python Dependency Auditing Guide
Secure your Python projects: Detect CVEs in dependencies using pip-audit and safety CLI. Installation, usage examples, benchmarks, CI integration for requirements.txt, Poetry, uv. Fix vulnerabilities fast – pip-audit tutorial, safety check best practices 2026.