Security packages

ASGI middleware that protects web applications against CSRF attacks by implementing the Double Submit Cookie pattern, validating tokens in form fields or HTTP headers.

Install it if you are building traditional server-rendered ASGI applications that handle form submissions.

Provides a Python 3 client library for the VirusTotal v3 REST API, including enterprise features like Live Hunt, Retro Hunt, and file analysis.

Lints, verifies, and gates plugins, skills, MCP servers, and packages in CI workflows to detect security risks before release.

Install it if you maintain plugins, skills, or MCP servers and want automated security gating before release.

k5test sets up isolated Kerberos 5 test environments and provides test case classes and decorators to run Python unit tests within those environments without affecting system Kerberos configuration.

However, note that maintenance is dormant (last release 877 days ago); if you need active support or compatibility with very recent Kerberos versions, evaluate…

Parses Windows Event Log files (.evtx) into structured XML or JSON, providing programmatic access to event records, templates, and metadata across Windows, macOS, and Linux.

Install it if you need to read Windows event logs outside Windows or integrate event log data into analysis pipelines.

Pyarmor.cli.core.linux provides pre-built extension modules for Python script obfuscation, machine binding, and expiration-date enforcement on Linux systems.

Pure Python implementation of the SLH-DSA stateless hash-based digital signature algorithm specified in FIPS 205, with no external dependencies.

However, verify whether the implementation has undergone formal security audit and whether performance meets your requirements before using in production systems with…

Acquire gathers forensic artifacts from disk images or live systems into a lightweight container, using the dissect framework to extract data from raw disk when possible.

GuardDog is a CLI tool that scans PyPI, npm, Go, Rust, RubyGems, GitHub Actions, and VSCode extension packages to identify malicious code and supply chain attacks using YARA rules and metadata analysis.

Install it if you need to audit dependencies across multiple package ecosystems or integrate package security checks into CI/CD; skip it if you only use a single…

Identifies and fingerprints web application firewalls (WAFs) by sending HTTP requests and analyzing responses to detect which WAF solution is protecting a target.

Install only if you have authorization to probe the target systems—unauthorized WAF detection may violate computer fraud laws.

oslo.privsep helps applications safely perform privileged operations by separating code that needs elevated permissions from the rest of the application, following the principle of least privilege.

Defines and enforces permission policies for records in Invenio digital repository systems, controlling who can access, modify, or delete record data.

Validates STIX 2.x JSON documents against the STIX 2.1 specification, checking both mandatory requirements via JSON schemas and recommended best practices via Python functions.

Pyarmor CLI Core Alpine provides pre-built extension modules for Pyarmor that enable obfuscation of Python scripts, machine binding, and expiration date enforcement on Alpine Linux systems.

However, the 'Free To Use But Restricted' license means the free trial has limitations; review the EULA and license terms before production use.

A Python client library for the ClamAV antivirus engine that connects to a running clamd daemon via TCP or Unix sockets, supporting file scanning on Windows, Linux, macOS, and other platforms.

Manages OAuth 2.0 access tokens in memory, automatically refreshing expired tokens and optionally reading them from files or environment variables.

Scans MCP (Model Context Protocol) servers and tools for security threats using YARA rules, LLM analysis, and Cisco AI Defense API, with support for CLI and REST API modes.

However, verify the license terms first—the license treatment is unclear in the metadata—and note that most scanning modes require external API keys.

Adds WebAuthn Passkey support to Django OTP, enabling passwordless and multi-factor authentication via biometric, security key, or platform authenticators.

oslo.rootwrap provides fine-grained filtering of shell commands to run as root from OpenStack services, enabling controlled escalation of permissions with minimal privilege exposure.

Adds OAuth2/OIDC JWT token validation and claim-based authorization (scopes, roles, permissions) to FastAPI APIs, with support for tokens from AWS Cognito, Auth0, Okta, Microsoft Entra, and other standard providers.

However, it is very new (first release 2025-11-09) with minimal adoption (139638 monthly downloads but only 14 GitHub stars), so production use should be preceded by…

PGPy13 is a Python library for OpenPGP encryption, decryption, and digital signature operations conforming to RFC 4880, with support for RSA, DSA, and ECDSA signatures and RSA/ECDH encryption.

However, be aware this is a temporary fork with minimal ongoing support—the maintainer will not accept pull requests or bug reports.

Provides Python models for the Open Cybersecurity Schema Framework (OCSF), enabling structured representation and manipulation of cybersecurity events, findings, and objects.

Install it if you need to work with OCSF-formatted cybersecurity data or integrate with platforms that expect OCSF compliance.

Scans Git repositories and other sources for leaked credentials, classifying and validating over 800 secret types to identify active security risks.

However, verify the GNU license variant's compatibility with your project before committing, and note that the PyPI package has not been updated since 2021-02-05—you…

Blocks brute-force login attempts in Django by tracking failed attempts via Redis cache, without requiring database queries on each login check.

Validates SPF, DMARC, BIMI, MTA-STS, and related email authentication DNS records, with API, CLI, and JSON/CSV output modes.

Parses YARA rule files into Python dictionary representations, enabling programmatic analysis and bulk transformation of malware detection rules.

Certbot-nginx is a plugin for Certbot that automates obtaining and deploying TLS certificates from Let's Encrypt to nginx web servers.

Python client library for the OWASP ZAP security scanner API, enabling programmatic access to automated web application security testing and vulnerability scanning.

Install it if you need to automate ZAP scanning in your development or testing workflow.

Encrypts and decrypts DynamoDB items client-side before transmission, using boto3 as a transparent wrapper with support for attribute-level encryption and cryptographic key management.

Install it if you need client-side encryption for DynamoDB items.

Unified installer that bundles policy enforcement, agent identity and trust infrastructure, execution supervision, and reliability monitoring into a single governance stack for production AI agents.

However, the package is in public preview with potential API changes; evaluate your tolerance for breaking changes before general availability.

Flawfinder scans C/C++ source code to identify potential security flaws and ranks them by likely severity.

Disassembles Ethereum EVM bytecode into assembly instructions and decompiles it to pseudocode, with static and dynamic analysis capabilities and online function signature lookup.

Converts Cerbos authorization query plans into SQLAlchemy Select queries, enabling attribute-based access control enforcement directly in database queries.

Install it if you use Cerbos and SQLAlchemy together and want to avoid loading unauthorized records into memory.

Provides Python bindings to the libmagic library for file type detection and MIME type identification using ctypes.

SSLyze is a fast SSL/TLS scanning tool and Python library that analyzes server configurations for encryption strength and known TLS vulnerabilities by connecting and inspecting certificate, cipher suites, and protocol settings.

However, the AGPL license is restrictive—proprietary projects must either accept copyleft obligations or avoid it.

Integrates FastAPI applications with cloud authentication services (AWS Cognito, Auth0, Firebase Authentication) to verify JWT tokens, validate scopes, and extract user claims.

A CLI tool that obtains temporary AWS credentials by authenticating through Okta via SAML, eliminating the need to manage long-lived AWS keys for Okta-integrated environments.

fs.sshfs provides a PyFilesystem2 interface to remote SSH/SFTP servers, letting you read, write, and navigate files over SSH as if they were a local filesystem.

Mixbox provides shared utility code for cybersecurity and threat intelligence libraries, handling common data structures and serialization logic used by python-cybox, python-maec, and python-stix.

Parses, manipulates, and generates Cyber Observable eXpression (CybOX) v2.1.0 content in XML and JSON formats through both low-level schema bindings and higher-level Python APIs.

Install it if you must work with existing CybOX content; avoid it for new projects unless CybOX is a hard requirement.