---
id: pip-audit
version: "2.10.1"
license: unclear
license_treatment: permissive
maintenance: active
---

# pip-audit — A tool for scanning Python environments for known vulnerabilities

License: permissive · Maintenance: active · Popularity: top 1,000 on PyPI

## Install

pip install pip-audit
uv add pip-audit
poetry add pip-audit

## Description

pip-audit
=========

<!--- BADGES: START --->
[![CI](https://github.com/pypa/pip-audit/workflows/CI/badge.svg)](https://github.com/pypa/pip-audit/actions/workflows/ci.yml)
[![PyPI version](https://badge.fury.io/py/pip-audit.svg)](https://pypi.org/project/pip-audit)
[![Packaging status](https://repology.org/badge/tiny-repos/python:pip-audit.svg)](https://repology.org/project/python:pip-audit/versions)
[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/pypa/pip-audit/badge)](https://api.securityscorecards.dev/projects/github.com/pypa/pip-audit)
[![License](https://img.shields.io/github/license/pypa/pip-audit)](https://github.com/pypa/pip-audit/blob/main/LICENSE)
<!--- BADGES: END --->

`pip-audit` is a tool for scanning Python environments for packages
with known vulnerabilities. It uses the Python Packaging Advisory Database
(https://github.com/pypa/advisory-database) via the
[PyPI JSON API](https://warehouse.pypa.io/api-reference/json.html) as a source
of vulnerability reports.

This project is maintained in part by [Trail of Bits](https://www.trailofbits.com/)
with support from Google. This is not an official Google or Trail of Bits product.

##...

## AI interpretation — verify before relying

pip-audit scans Python environments and requirements files for packages with known vulnerabilities using the Python Packaging Advisory Database, supporting multiple vulnerability services and output formats including SBOMs.

Verdict: pip-audit is a well-maintained, actively developed security tool from the PyPA ecosystem with no known vulnerabilities, low installation friction, and permissive licensing. It is suitable for integration into CI/CD pipelines and local development workflows to detect vulnerable dependencies.

[View on SkillFed](https://skillfed.io/packages/pip-audit) · [View on PyPI](https://pypi.org/project/pip-audit/)