Security packages

Adds CAPTCHA image challenges to Django forms with customizable text, math, or audio challenges, and supports text-to-speech accessibility.

Adds user authentication and access control to Streamlit applications, supporting login, registration, password reset, two-factor authentication, and OAuth2 integration.

Install it if you're building a multi-user Streamlit app that requires authentication; the alternative is implementing security infrastructure yourself.

Stem is a Python controller library for interacting with Tor, allowing applications to query and command Tor instances over the control protocol.

The copyleft LGPLv3 license requires careful review if you plan to distribute derivative work.

HOL Guard is a local-first antivirus and runtime protection layer for AI agents that evaluates agent actions, tool calls, package installs, and MCP servers for secrets exposure, prompt injection, unsafe commands, and malicious packages before they execute.

Install it if you run AI agents on your machine and want runtime visibility and control over their actions.

Implements JSON Web Signature (JWS) and JSON Web Encryption (JWE) for securely creating and verifying JSON Web Tokens (JWTs) that carry claims for authorization and authentication.

Adds reCAPTCHA v2 and v3 field validation to Django REST Framework serializers, integrating Google's bot-detection service into API endpoints.

A Python SDK that wraps the Socket.dev REST API, enabling programmatic access to package security analysis, SBOM export, and full-scan operations from Python code.

Install it if you need programmatic access to Socket.dev's package security API from Python; skip it if you only need one-off lookups via the web UI.

Parses, compares, and evaluates Common Platform Enumeration (CPE) identifiers in WFN, URI, and FS formats according to MITRE/NIST standards.

bingo is an AI-powered red team terminal that automates security testing across web applications, mobile apps, and smart contracts by accepting natural-language targets and tasks, then orchestrating attacks like SQLi, XSS, WAF bypass, and credential extraction.

aiocoap is a Python library for writing CoAP (Constrained Application Protocol) clients and servers using asyncio, enabling communication with network-enabled IoT and embedded devices.

Python bindings for creating osquery extensions and querying osquery instances via SQL, allowing you to extend osquery with custom tables or execute queries against running osquery processes.

However, be aware that maintenance is dormant—no active development or bug fixes are expected—and the classifiers only list Python up to 3.6, so compatibility with…

Prowler automates security and compliance assessments across multiple cloud providers using hundreds of built-in security checks and compliance frameworks.

Parse binary data using C-like structure definitions, converting raw bytes into typed Python objects and back again.

Provides OAuth 2.0 token management for H2O Python clients, handling refresh token exchange and access token lifecycle with both sync and async interfaces.

Install only if you need OAuth token management for H2O services; it is not a general-purpose OAuth library.

Generates Swagger API documentation and interactive UI for aiohttp web servers, allowing you to document REST endpoints and browse them through a Swagger console.

However, verify compatibility with your Python version and aiohttp release before committing, and be aware that the maintainer is seeking new contributors—consider…

Builds and validates TLS certificate chains by fetching missing intermediate certificates via the AIA (Authority Information Access) extension, working around CPython issue 18617 where servers don't provide the full chain.

However, its pre-alpha status and dormant maintenance (last release 2021-11-27) mean no active support or updates; use it as a workaround, not a long-term solution.

Encrypts and decrypts files and binary streams using AES256-CBC, compatible with the AES Crypt file format (version 2).

Install it if you are not expecting active security updates or bug fixes; avoid it if you require ongoing support or are encrypting data where file-size tampering is…

GeoIP2Fast performs fast geolocation lookups for IPv4 and IPv6 addresses, returning country codes, city names, ASN information, and CIDR blocks from a local binary data file.

LLM Guard provides input and output scanning for Large Language Models to detect and prevent prompt injection, data leakage, harmful language, and other security threats.

No—not for new projects.

Python SDK for Keeper Secrets Manager that retrieves and manages secrets from a Keeper vault, with support for custom server configurations and encrypted credential access.

Install it if your application needs to retrieve secrets from a Keeper vault at runtime.

A Certbot plugin that automates DNS validation for Let's Encrypt certificate issuance using AWS Route53, enabling hands-off HTTPS certificate provisioning for domains hosted on Route53.

Install it if you host domains on Route53 and want to automate Let's Encrypt certificate provisioning without manual DNS or web server configuration.

Hyperlight-sandbox provides a Python API for executing code inside isolated sandboxes with pluggable backends (WASM, HyperlightJS) and guest language runtimes, enabling secure code execution with tool registration and snapshot/restore semantics.

However, verify that snapshot/restore semantics and backend stability meet your production requirements before relying on it for critical workloads.

AccessControl provides a security framework for Zope that enforces access control and authorization rules through guarded attribute access and role-based permission checking.

Not recommended outside Zope ecosystems—it is tightly coupled to Zope's object model and has no standalone use case.

Compliance-trestle manages, validates, and transforms OSCAL (NIST's compliance standard format) documents, splitting large structures into editable pieces while enforcing schema compliance and supporting markdown-to-OSCAL conversion.

Wraps the requests library to enforce security defaults and block SSRF attacks by filtering private and loopback IP addresses.

Install it if SSRF protection or global timeout/redirect policies matter for your threat model; skip it if your requests are fully trusted or you handle these…

Implements the LTI 1.3 Advantage specification for Python web applications, providing OIDC login and message launch handling with built-in adapters for Django and Flask.

However, verify compatibility with your target LMS versions and be prepared to fork or patch if critical issues arise post-2022, since the original maintainer is not…

Provides utility functions and decompression algorithms (LZ4, LZO) for the Dissect forensic analysis framework, with optional native Rust implementations for performance.

Decode and re-encode Protocol Buffer messages without access to the source .proto descriptor file, making educated guesses about field types based on wire-type metadata.

Install it if you work with protobuf-based systems in security, testing, or reverse-engineering contexts.

A drop-in replacement for Python's standard logging.Formatter that escapes carriage returns and linefeeds in log output to prevent CRLF injection attacks (CWE-93 and CWE-117).

Provides a WebAssembly backend implementation for the hyperlight-sandbox Python API, enabling sandboxed code execution via Wasm.

Temporarily override environment variables within a scoped context, automatically restoring the original state when the block exits.

dncil is a Python library for disassembling Common Intermediate Language (CIL) instructions from .NET managed methods, parsing headers, instructions, and exception handlers into an object-oriented API.

Install it if you need to analyze .NET CIL bytecode from Python—particularly for malware analysis, reverse engineering, or security research.

Provides Python access to 1Password vaults through a self-hosted 1Password Connect server, allowing applications to read and write secrets programmatically.

Install it if you need programmatic access to 1Password vaults from Python.

Cycode is a command-line security scanner that detects secrets, infrastructure-as-code misconfigurations, software composition vulnerabilities, and static analysis issues in your repositories.

Install it if you need a unified CLI for secrets, IaC, SCA, and SAST scanning; authentication setup is required before first use.

nassl is an OpenSSL wrapper for Python that exposes low-level SSL/TLS functions needed for SSL server scanning and testing, with a C extension layer that closely mirrors OpenSSL's API.

Skylos is a local-first static analysis CLI that scans Python, TypeScript, JavaScript, Java, Go, Kotlin, PHP, Rust, Dart, C#, Shell, and deployment configs for dead code, security flaws, secrets, quality regressions, and AI-generated code mistakes.

Install it if you need multi-language static analysis, AI-code verification, or a unified security gate; the 19 dependencies are justified by broad language support…

SMDA is a recursive disassembler library that recovers control flow graphs from binary files and memory dumps, supporting x86/x64, AArch64, .NET CIL, and Dalvik bytecode with output as functions, basic blocks, and instruction-level edges.

Install it if you need to extract control flow structure from binaries or memory dumps; avoid it if you only need basic disassembly without CFG analysis or if you…

Wrapper library for the NIST National Vulnerability Database API that retrieves CVEs and CPEs as Python objects with built-in rate limiting.

Extends Azure Identity to enable authentication through platform-native authentication brokers (WAM on Windows/WSL, Company Portal on macOS, Microsoft Identity Broker on Linux) via the InteractiveBrowserBrokerCredential class.

Install it if you are building a desktop application that needs to authenticate against Microsoft Entra ID and can rely on a platform broker being present.

Detects and redacts personally identifiable information (PII) text in images and DICOM medical files using OCR and named-entity recognition.

The main gotcha is the Tesseract OCR system dependency—plan for that installation before deploying.