Security packages

Provides Python bindings to the FreeDesktop.org Secret Service API for securely storing and retrieving passwords and secrets through GNOME Keyring, KWallet, or KeePassXC.

MSAL for Python handles OAuth2 and OpenID Connect authentication with Microsoft identity services, managing token acquisition, caching, and refresh for applications integrating with Microsoft Entra ID, Microsoft Accounts, and Azure AD B2C.

joserfc implements JOSE standards (JWS, JWE, JWK, JWT, and related RFCs) for signing, encrypting, and managing JSON-based cryptographic tokens in Python.

Authlib provides a complete implementation of OAuth 1.0, OAuth 2.0, and OpenID Connect 1.0 for building both authentication clients and servers, with built-in support for JWS, JWK, JWA, and JWT standards.

Provides low-level CFFI bindings to the official Argon2 password hashing algorithm for use by libraries and applications that need direct access to Argon2 without higher-level abstractions.

ADAL for Python authenticates applications with Azure Active Directory to obtain tokens for accessing Azure AD-protected resources.

Install only if maintaining existing code that already depends on it, and plan a migration.

Disables the CVE-2023-47248 security vulnerability in older PyArrow versions by patching unsafe deserialization behavior when imported.

Provides data models, validators, and serialization tools to create, read, and render CycloneDX Bill of Materials (BOM) documents in Python.

Install it if you are building tooling that needs to create, read, or validate CycloneDX documents; do not install it as a standalone SBOM generator—use CycloneDX…

Semgrep is a static analysis tool that searches source code for bugs, security vulnerabilities, and policy violations using patterns that resemble the code being analyzed, supporting 30+ languages.

Install it if you need multi-language static analysis and are comfortable with the LGPL-2.1-or-later license.

Generates OIDC identity tokens by automatically detecting the current environment (GitHub Actions, GitLab, Google Cloud, Buildkite, CircleCI) and retrieving ambient credentials without manual configuration.

Bandit scans Python code to identify common security issues by analyzing the abstract syntax tree and reporting findings in a structured format.

pip-audit scans Python environments and requirements files for packages with known vulnerabilities, using the Python Packaging Advisory Database and multiple vulnerability services.

Checkov is a static code analysis tool that scans infrastructure-as-code files (Terraform, CloudFormation, Kubernetes, Dockerfile, and others) and container images to detect security misconfigurations and software vulnerabilities.

Install it if you use Terraform, CloudFormation, Kubernetes, or Dockerfile in your infrastructure pipeline.

Python bindings for the BLAKE3 cryptographic hash function, exposing the official Rust implementation with support for keyed hashing, key derivation, extendable output, and multithreaded hashing.

Install it if you need modern hashing with keyed or key-derivation modes; the medium install friction is acceptable for most environments since binary wheels are…

A keyring backend that authenticates to Google Cloud Artifact Registry using Application Default Credentials or gcloud SDK tokens, enabling pip and twine to access private Python repositories.

Magika identifies file types using deep learning, analyzing file content to determine MIME types and file categories with high accuracy, available as both a command-line tool and Python library.

Install it if you need reliable file type identification beyond simple extension or magic-byte checks; skip it only if your use case is limited to a handful of…

Represents and manipulates IPv4, IPv6, MAC addresses and related network objects; supports CIDR notation, subnetting, set operations, IANA lookups, and DNS reverse generation.

Trafilatura extracts main text, metadata, and structured content from web pages and HTML, converting raw HTML into clean, usable data in multiple output formats.

Validates, normalizes, filters, and samples URLs for web crawling and document collection, removing spam, trackers, and low-value pages while respecting language and content-type constraints.

Install it if you are building a crawler or bulk collection pipeline and need to filter, normalize, or sample URLs at scale.

Manages Azure Key Vault resources—vaults, keys, secrets, and managed HSMs—through the Azure Resource Manager API.

Install it if you need to manage Azure Key Vault infrastructure from Python.

Turns a Python application into a SAML 2.0 Service Provider, enabling single sign-on and single logout with identity providers through standardized XML-based federation.

However, maintenance is aging (last release 2023-10-09); verify that it supports your IdP's current SAML profile and that you can manage the xmlsec and lxml system…

RestrictedPython compiles and executes a restricted subset of Python code in a controlled environment, preventing access to dangerous operations like arbitrary imports and unsafe attribute access.

However, it is not a complete sandbox—it requires careful design of your safe_globals and guard functions to be effective.

PGPy implements OpenPGP (RFC 4880) in pure Python, enabling you to load, create, and verify RSA, DSA, and ECDSA signatures, and encrypt/decrypt messages using RSA and ECDH.

oletools is a suite of Python tools to extract, analyze, and detect malicious content in Microsoft OLE2 files (Office 97-2003, MSI, Outlook) and OpenXML documents (Office 2007+, XPS, MSIX), focusing on VBA macros, embedded objects, DDE links, and Flash.

Disassembles VBA p-code from Microsoft Office documents to reveal the compiled macro instructions that actually execute, regardless of whether source code is present.

However, do not rely on it for modern Office versions (2010+) without testing—the package is abandoned and has known disassembly gaps in 64-bit Office 2016.

Automates DNS validation for Let's Encrypt certificate issuance by managing Cloudflare DNS records through Certbot's plugin system.

Install it if you use Cloudflare for DNS and want to automate Let's Encrypt certificate issuance via DNS validation; skip it only if you use a different DNS provider…

Detects personally identifiable information (PII) entities in text using regex, named entity recognition, and language models, with support for custom recognizers and multiple LLM providers.

Provides enhanced HTTPS support for Python's httplib and urllib2 (or http.client and urllib in Python 3) by wrapping PyOpenSSL to enable full SSL peer verification using certificate validation.

Implements the ACME protocol to automate certificate provisioning and renewal from Let's Encrypt and other ACME-compliant certificate authorities.

Install it if you need to automate certificate provisioning from Let's Encrypt or other ACME services, either as part of Certbot or as a library for custom…

mitmproxy is an interactive, SSL/TLS-capable intercepting proxy that captures and inspects HTTP/1, HTTP/2, and WebSocket traffic with console, command-line, or web-based interfaces.

Install it if you need interactive traffic inspection, debugging, or testing capabilities.

Wraps httpx.AsyncClient.get() with DNS validation and DNS rebinding protections to prevent Server Side Request Forgery (SSRF) attacks.

Install it if SSRF is a real threat in your application; skip it if you are not accepting untrusted URLs or are not using async code.

Estimates password strength by analyzing patterns, common words, and user data, returning a score from 0 to 4 plus actionable feedback and crack-time estimates.

Install it if you need realistic password strength estimation with actionable feedback rather than simple regex or entropy rules.

Safety CLI scans Python project dependencies for known vulnerabilities and malicious packages, then reports findings and can automatically update vulnerable dependencies to secure versions.

Detects and masks sensitive data in text using regex patterns, with built-in rules for common secret types and options to replace matches with symbols or SHA256 hashes.

Not recommended if you need active maintenance, custom pattern tuning, or support for emerging secret formats.

Python-GSSAPI wraps the GSSAPI C libraries to provide both low-level RFC 2744-compliant and high-level Pythonic APIs for Kerberos authentication and related security mechanisms.

Scapy is a Python library for forging, decoding, sending, and capturing network packets across many protocols, enabling interactive packet manipulation and network analysis tasks.

However, the GPL-2.0 copyleft license is a hard blocker for proprietary software, and you must have root/administrator access to use packet capture and injection…

Adds one-time password (OTP) support to Django applications, enabling two-factor authentication through HOTP and TOTP algorithms integrated with Django's authentication system.

However, the lack of active development means you should verify that any OTP plugins you need remain compatible with your Django version, and consider…

zizmor is a static analysis tool that scans CI/CD configurations—GitHub Actions, Dependabot, and pre-commit—to identify and fix security vulnerabilities like template injection, credential leakage, and excessive permission grants.

Replaces detected PII text entities with anonymized values using configurable operators like redaction, masking, hashing, encryption, or custom functions.

Wraps the Kerberos 5 C API to provide Python functions for low-level Kerberos operations, with functions matching the KRB5 API specification.