pip-audit
A tool for scanning Python environments for known vulnerabilities
Decision gist · record as of 2026-08-14
Yes. pip-audit is a production-stable, actively maintained tool with low install friction and no known vulnerabilities. It fills a critical security niche—scanning for known vulnerabilities in Python dependencies—and is widely used (top 1000 PyPI packages). The permissive Apache license and integration with standard Python tooling (pip, pre-commit, GitHub Actions) make it a straightforward addition to any Python project's security workflow.AI-flagged interpretation of the facts on this page — verify before relying
Before you install
- Requires Python 3.10 or newer.
- Low install friction with a pure-Python wheel distribution.
- Actively maintained with a recent release; last commit on 2026-08-12 and 1344 repository stars indicate ongoing support.
License · maintenance · safety
permissive license (permissive) — Licensed under Apache Software License (permissive), allowing commercial and private use with minimal restrictions.
last release 2026-06-10 (65 days) · last repo commit 2026-08-12 · 1,344 stars
0 known vulnerabilities (OSV.dev, 2026-08-14) · 28,288,779 downloads/mo, #838 on PyPI
Alternatives
Verify before relying
pip install pip-audit
pip-audit
# or audit a requirements file:
pip-audit -r requirements.txt- Whether the tool can automatically fix vulnerabilities with --fix flag and what constraints apply to that operation.
- Performance characteristics when scanning large environments or many requirements files.
- Whether OSV and ESMS vulnerability services require authentication or have rate limits.
What it is and what it does
pip-audit is a command-line security scanner that identifies Python packages with known vulnerabilities in your local environment or requirements files. It queries the Python Packaging Advisory Database through multiple vulnerability services (PyPI, OSV, ESMS) to detect issues and can output results in human-readable or machine formats including JSON and CycloneDX SBOMs. The tool integrates with pip's caching, supports dry-run audits, and can optionally attempt automatic fixes for vulnerable dependencies.
The package is maintained by Trail of Bits with Google support and is classified as Production/Stable. It has 10 runtime dependencies including requests for API calls, rich for formatted output, and packaging utilities for parsing requirements and lock files. Installation is straightforward via pip, and the tool works as both a standalone command and a Python module.
Use it for
- Scan a local Python environment for vulnerable packages before deployment to catch security issues early.
- Audit requirements.txt or lock files in CI/CD pipelines to enforce vulnerability policies on dependencies.
- Generate a CycloneDX SBOM in JSON or XML format for compliance and supply-chain security tracking.
- Integrate with pre-commit hooks to audit dependencies automatically before committing code changes.
- Compare vulnerability reports across multiple services (PyPI and OSV) for comprehensive coverage.
Worth the install?
AI-flagged interpretation of the facts on this page. Verify before relying on it.
Yes.
pip-audit is a production-stable, actively maintained tool with low install friction and no known vulnerabilities. It fills a critical security niche—scanning for known vulnerabilities in Python dependencies—and is widely used (top 1000 PyPI packages). The permissive Apache license and integration with standard Python tooling (pip, pre-commit, GitHub Actions) make it a straightforward addition to any Python project's security workflow.
Install
pip-audit on PyPI
Before you install
Low install friction with a pure-Python wheel distribution. Actively maintained with a recent release; last commit on 2026-08-12 and 1344 repository stars indicate ongoing support.
Requires Python 3.10 or newer.
License in practice
Licensed under Apache Software License (permissive), allowing commercial and private use with minimal restrictions.
Quickstart
pip install pip-audit
pip-audit
# or audit a requirements file:
pip-audit -r requirements.txtVerify before relying
- Whether the tool can automatically fix vulnerabilities with --fix flag and what constraints apply to that operation.
- Performance characteristics when scanning large environments or many requirements files.
- Whether OSV and ESMS vulnerability services require authentication or have rate limits.
Package facts
| License | permissive license permissive |
| Python support | Supports the current Python release >=3.10 |
| Install friction | Low. Pure-Python wheel |
| Runtime dependencies | 10 packagesCacheControlcyclonedx-python-libpackagingpip-apipip-requirements-parserrequestsrichtomlitomli-wplatformdirs |
| Maintenance | Actively maintained 65 days since the last release |
| Last repo commit | |
| First released | |
| Downloads | 28,288,779 / month, #838 on PyPI 30-day window, as of 2026-08-14 |
| Known vulnerabilities | None known OSV.dev, checked 2026-08-14 |
| Classifiers | Development Status :: 5 - Production/StableIntended Audience :: DevelopersLicense :: OSI Approved :: Apache Software LicenseProgramming Language :: Python :: 3Programming Language :: Python :: 3 :: OnlyProgramming Language :: Python :: 3.10Programming Language :: Python :: 3.11Programming Language :: Python :: 3.12Programming Language :: Python :: 3.13Programming Language :: Python :: 3.14Topic :: Security |
Evidence: pip_audit-2.10.1-py3-none-any.whl
Tags
Let your AI agent find packages like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 14,416 PyPI packages by what they can do, searchable in plain language.
wish › “pip security audit”
- pip-auditpip-audit scans Python environments and requirements files for…
- pip-checkpip-check displays all installed packages and their update status in…
- pip-licensesA command-line tool that scans installed Python packages and outputs…
Give your agent the search over MCP, or paste the wish link into any chat.
More Security packages
Provides Python bindings to the FreeDesktop.org Secret Service API for securely storing and retrieving passwords and secrets through GNOME Keyring, KWallet, or KeePassXC.
MSAL for Python handles OAuth2 and OpenID Connect authentication with Microsoft identity services, managing token acquisition, caching, and refresh for applications integrating with Microsoft Entra ID, Microsoft Accounts, and Azure AD B2C.
joserfc implements JOSE standards (JWS, JWE, JWK, JWT, and related RFCs) for signing, encrypting, and managing JSON-based cryptographic tokens in Python.
Authlib provides a complete implementation of OAuth 1.0, OAuth 2.0, and OpenID Connect 1.0 for building both authentication clients and servers, with built-in support for JWS, JWK, JWA, and JWT standards.
Provides low-level CFFI bindings to the official Argon2 password hashing algorithm for use by libraries and applications that need direct access to Argon2 without higher-level abstractions.
ADAL for Python authenticates applications with Azure Active Directory to obtain tokens for accessing Azure AD-protected resources.
Install only if maintaining existing code that already depends on it, and plan a migration.
See also pip-api · uv-secure · pysentry-rs · safety · ca9 · pip2pi · pipmaster · cloudsec-audit · abi3audit · cwe2