Safety DB is a database of known security vulnerabilities in Python packages. The data is made available by pyup.io and synced with this repository once per month. Most of the entries are found by filtering CVEs and changelogs for certain keywords and then manually reviewing them.
pipenv checkrelies on
safetyand Safety-DB to check for known vulnerabilities in locked components
pip install safety-db
from safety_db import INSECURE, INSECURE_FULL
This is not a hall of shame, or a list of packages to avoid. The package maintainers show a great responsibility by documenting and fixing security issues in such a way that they can be listed here. That's extremely valuable when considering using a package in production.
Check out the
The database is licensed under CC BY-NC-SA 4.0. This allows you to use the data in any non commercial project as long as you link back to this repo. If you need a license for a commercial project, please contact firstname.lastname@example.org.