ⓘ NOTE: This is a draft. Contributions welcome!
Web: https://best.openssf.org/Secure-Coding-Guide-for-Python/
GitHub: https://github.com/ossf/wg-best-practices-os-developers/tree/main/docs/Secure-Coding-Guide-for-Python

An initiative by the OpenSSF to provide new Python programmers a resource to study secure coding in CPython >= 3.9 with working code examples.

Documentation is written in academic style to support security researchers while using plain English to cater for an international audience.

Python modules outside of the Python Module Index [Python 2023] are specifically not covered by this document.

Please join us, see contributing

Disclaimer

Content comes WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, as stated in the license text CC-BY-4.0 for documentation and MIT. Following or using the documentation and or code is at your own risk. Code examples are intended purely for educational use and not for products in parts or in full. Code examples are NOT to be used to cause harm of any kind to anyone or anything.

Introduction

Every person writing code shall study the following:

Secure Coding Standard for Python

Code examples are written to explain security design with as little code as possible. None of the code examples are intended to be used ‘as is’ for production. Using the code is at your own risk!

Code file naming conventions:

  • noncompliantXX.py anti-pattern, bad programming practice.
  • compliantXX.py mitigation or removal of ONLY the described risk.
  • exampleXX.py to allow understanding the documented behaviour.

It is not production code and requires code-style or python best practices to be added such as:

  • Inline documentation
  • Custom exceptions
  • Full descriptive variable names
  • Line length limit
  • Proper logging instead of printing to stdout
  • Secure coding compliance outside of described issue
01 Introduction Prominent CVEs MITRE
pyscg-0040: Use Process Isolation for Trust Zones CVE-2023-28597,
CVSSv3.0: 7.5,
EPSS: 00.11 (05.11.2024)
CWE-501
pyscg-0041: Externalize Configuration and Secrets CWE-798
pyscg-0042: Ensure Correct Operator Precedence CWE-783
pyscg-0055: Determine Access on Server Side CWE-472
02 Encoding and Strings Prominent CVEs MITRE
pyscg-0043: Specify Locale Explicitly CWE-175
pyscg-0044: Canonicalize Input Before Validating CVE-2022-26136,
CVSSv3.1: 9.8,
EPSS: 00.28 (31.12.2025)
CWE-180
pyscg-0045: Enforce Consistent Encoding CWE-176
03 Numbers Prominent CVEs MITRE
pyscg-0001: Control Numeric Precision CWE-1339
pyscg-0002: Guard Fixed-Width Numbers Against Overflow CWE-191, CWE-190
pyscg-0003: Use Arithmetic Over Bitwise Operations CWE-1335
pyscg-0004: Use Integer Loop Counters CWE-197
pyscg-0005: Specify Rounding for Numeric Conversions CWE-197
pyscg-0006: Use an Appropriate Comparator for Numbers CWE-681
pyscg-0007: Use String Literals for Decimal Construction CWE-681
04 Neutralization Prominent CVEs MITRE
pyscg-0047: Use Allow Lists Over Deny Lists CWE-184
pyscg-0008: Prevent Format String Injection CVE-2022-27177,
CVSSv3.1: 9.8,
EPSS: 00.37 (01.12.2023)
CWE-134
pyscg-0009: Prevent OS Command Injection CVE-2024-43804,
CVSSv3.1: 8.8,
EPSS: 00.06 (08.11.2024)
CWE-78
pyscg-0010: Prevent SQL Injection CVE-2019-8600,
CVSSv3.1: 9.8,
EPSS: 01.43 (18.02.2024)
CWE-89
pyscg-0011: Prevent Type Confusion CVE-2021-29513,
CVSSv3.1: 7.8,
EPSS: 00.02 (13.05.2025)
CWE-843
pyscg-0012: Extract Archives Safely CVE-2019-9674,
CVSSv3.1: 7.5,
EPSS: 1.2% (10.09.2025)
CWE-409
pyscg-0013: Secure Search Paths CVE-2015-1326,
CVSSv3.0: 8.8,
EPSS: 00.20 (23.11.2023)
CWE-426
pyscg-0023: Secure Deserialization CVE-2018-8021,
CVSSv3.0: 9.8,
EPSS: 93.54 (05.11.2024)
CWE-502
05 Exception handling Prominent CVEs MITRE
pyscg-0014: Use Specific Exception Types CWE-397
pyscg-0015: Handle Error Conditions CVE-2024-39560,
CVSSv3.1: 6.5,
EPSS: 0.04 (01.11.2024)
CWE-755
pyscg-0016: Propagate Exceptions and Preserve Context CWE-396
pyscg-0018: Validate Numeric Data Beyond Type Checking CWE-754
pyscg-0052: Ensure Cleanup on Exceptions CWE-460
06 Logging Prominent CVEs MITRE
pyscg-0019: Insertion of Sensitive Information into Log File CVE-2023-45585,
CVSSv3.1: 9.8,
EPSS: 0.04 (01.11.2024)
CWE-532
pyscg-0020: Insufficient Logging CWE-778
pyscg-0021: Active Debug Code CVE-2018-14649,
CVSSv3.1: 9.8,
EPSS: 69.64 (12.12.2023)
CWE-489
pyscg-0022: Improper Output Neutralization for Logs CWE-117
pyscg-0050: Generation of Error Message Containing Sensitive Information CWE-209
07 Concurrency Prominent CVE MITRE
pyscg-0024: Uncontrolled Resource Consumption CWE-400
pyscg-0025: Insufficient Resource Pool CWE-410
pyscg-0026: Deadlock CWE-833
pyscg-0027: Concurrent Execution Using Shared Resource with Improper Synchronization ('Race Condition') CWE-362
pyscg-0028: Return inside Finally Block CWE-584
pyscg-0029: Improper Initialization CWE-665
pyscg-0030: Missing Report of Error Condition CWE-392
pyscg-0051: Improper Resource Shutdown or Release CWE-404
pyscg-0054: Race Condition Within a Thread CWE-366
08 Coding Standards Prominent CVE MITRE
pyscg-0031: Use Copies When Modifying Iterables CWE-1095
pyscg-0032: Avoid Redefining Built-in Functions or Standard Library Identifiers CWE-1109
pyscg-0033: Implement Comparisons by Value Rather Than Reference CWE-595
pyscg-0034: Check for None Values CWE-476
pyscg-0035: Complete Resource Cleanup CWE-459
pyscg-0036: Check Return Values CWE-252
pyscg-0037: Avoid Assertions In Production CWE-617
09 Cryptography Prominent CVE MITRE
pyscg-0038: Use Sufficiently Random Values CVE-2020-7548,
CVSSv3.1: 9.8,
EPSS: 0.22 (12.12.2024)
CWE-330

Biblography

Ref Detail
[Python 2023] 3.9 Module Index [online], available from https://docs.python.org/3.9/py-modindex.html [accessed Dec 2024]
[mitre.org 2023] CWE - CWE-1000: Research Concepts [online], available from https://cwe.mitre.org/data/definitions/1000.html [accessed Dec 2024]
[OWASP dev 2024] OWASP Developer Guide [online], available from https://owasp.org/www-project-developer-guide/release/ [accessed Dec 2024]
[OWASP 2021] OWASP Top 10 Report 2021 [online], available from https://owasp.org/www-project-top-ten/
[MITRE Pillar 2024] Pillar Weakness [online], available form https://cwe.mitre.org/documents/glossary/#Pillar%20Weakness [accessed Dec 2024]
[MITRE 2024] CWE Top 25 [online], available form https://cwe.mitre.org/top25/index.html [accessed Dec 2024]

Contributors

This guide was jointly developed by the following group of awesome contributors:

  • Andrew Costello
  • Bartlomiej Karas
  • David A. Wheeler
  • Dean Wiley
  • Georg Kunz
  • Helge Wehder
  • Hubert Daniszewski
  • Ketki Davda
  • Kyrylo Yatsenko
  • Michael Scovetta
  • Noah Spahn
  • Tom McDermott
  • Viktor Szépe

License