From Vulnerable to Verifiable: Master Python File I/O Today How To Open a file securely open.substack.com/pub/nocomple... #pycon #pydata #owasp #infosec

Never trust #Python importlib.import_module in programs of others! Allowing dynamically module imports makes it easy to execute arbitrary code. Possible mitigation:Use the Python Code Audit to check the code upfront! github.com/nocomplexity... #security #infosec #owasp #vulnerability

#fosdem 2026 was again a great party for all #FOSS addicts. FOSDEM is still the #1 FOSS conference for developers to learn and meet like-minded people. This year with a great talk of @agoose77.bsky.social on things possible with #JupyterBook (version 2!) Check it out on jupyterbook.org

Many Python code weaknesses are detected in the #Open Source Python SAST tool, Python Code Audit github.com/nocomplexity... #fosdem #pydata #infosec #owasp

I checked more than 1200 URLs on validity. Great new input is added! This guide is to solve your most complex security challenges using practical, proven strategies. Free at nocomplexity.com/documents/se... Or as PDF on nocomplexity.gumroad.com/l/SecurityAr... #infosec #fosdem #cybersecurity

Why ‘Zero Trust’ is Mostly Just Zero Transparency FOSS: The Only Cybersecurity You Can Actually Trust? Still never trust, always verify! open.substack.com/pub/nocomple... #trust #gpl #foss #opensource #cybersecurity

From Hours to Seconds: Automating Python Security with AI? The Truth About AI Python Security Tools: A Balanced Deep Dive. open.substack.com/pub/nocomple... #fosdem #python #gemeni #openai

Defence in Depth in Python Security: Why Using Multiple SAST Tools Matters open.substack.com/pub/nocomple... #python #security #gpl #foss

How to Stop Directory Traversal Attacks in Python - The Danger of Directory Traversal open.substack.com/pub/nocomple... #python #appsec #programming

Sha256 algorithm explained, The Illustrated TLS 1.3 Connection, OWASP Juice Shop and more free #CyberSecurity courses! nocomplexity.com/documents/se... Input? Let me know! #owasp #free #Learning

I advocate for ‘simple’ Open Cybersecurity solutions. At minimum, this means #opensource software with maintainable code and a security.md file that makes reporting vulnerabilities possible in under 10 seconds! github.com/nocomplexity... #fosdem #security #pycon

DO NOT rely on SAST #security scanners that are powered by AI-agents to solve cyber security problems! Most are just far from good enough. In the best case scenario, you’ll only be disappointed. But the risk of a false sense of security is enormous. Use github.com/nocomplexity...

I was curious to know how many security-related talks are held at large Python conferences, so I analysed the largest PyCon conferences of the last few years. open.substack.com/pub/nocomple... #pycon #owasp #appsec

The Fastest Way to Validate External Python Modules Instant #python Security Validation Without a #Headache open.substack.com/pub/nocomple... #cyber #pycon #appsec #owasp

Python Code goes through parsing, complication and execution. Python's execution model combines interpretation with compilation. Python’s popularity make it a target for malicious actors: Python code is not secure by default! codeaudit.nocomplexity.com #CPython #owasp #pycon

Python security is gaining attention due to the still rising usage. Python can be considered a secure language, yet Python applications are susceptible to common security flaws. github.com/nocomplexity... #pycon #fosdem #owasp

Avoid Python SAST scanners based on AI open.substack.com/pub/nocomple... #pydata #pycon #fosdem

The 2026 SAST Shortlist: What’s Actually Worth Using? Spoiler …there is not so much choice… open.substack.com/pub/nocomple...

#Python function: def dangerous_calculator(user_input): print(f"Entered: {user_input}") exec(user_input) Someone will do: dangerous_calculator("__import__('os').system('rm -rf /')") Always check code with Python Code Audit! github.com/nocomplexity... #infosec #owasp #pycon #programming

Never do: func_name = input("Enter function to run: ") exec(f"{func_name}()") Using `exec` in Python code is the fastest way to turn your Python script into a remote code execution vulnerability. Read: nocomplexity.com/exec-in-pyth... #python #pycon #owasp #appsec #infosec

#Threatmodelling is identifying and analysing potential security threats and vulnerabilities in a system, application, or network. To mitigate potential security risks with a balanced budget, security threat modelling is critical. Use the (free) SAST for #Python nocomplexity.com/codeaudit/ #owasp

Every Python package that is able to dynamically load code is suspicious by default! Use github.com/nocomplexity... to check what happens. #pycon #python #owasp #infosec #appsec #programming #sast

Is DySec the Future for securing the Python package repository? Check: nocomplexity.com/dysec-pypi-s... #pycon #owasp #cybersecurity #infosec #programming #pypi #python

#Radical #Open Innovation News: The Anti-Ownership Ebook Economy A great read on how Publishers and Platforms Have Reshaped the Way We Read in the Digital Age. With solutions for getting control back. Check www.bm-support.org/roi-news-wee... for all #innovation news bites. #cop30 #openness

#Radical #Open Innovation News: The #PyPSA meets Earth initiative works on open modelling. Check www.bm-support.org/roi-news-wee... for all #innovation news bites. #cop30 #greenenergy #python #openness #roi

The random module in Python is not for security or cryptographic purposes, such as generating session tokens,, or passwords. Use the #free SAST Tool: Python Code Audit - github.com/nocomplexity... To check on use of the random module in #code #pycon #owasp #random #infosec #cyber

Python does not implement privilege separation. Once an attacker is able to execute arbitrary Python code, the attacker gets the same privileges that is used to run the program. So use Python Code Audit- an advanced SAST tool github.com/nocomplexity... #owasp #pycon #appsec

In today’s world, security remains a critical concern. Python Secure Coding Guidelines are for anyone who wants to create #Python programs that are secure by design. Check: nocomplexity.com/python-secur... #pycon #appsec #owasp #programming #ai #free #checklist

Voorkom Cyber Security incidenten. Simpel en effectief. Python Code Audit is de #1 open source oplossing om kwetsbaarheden in #Python programma’s te vinden. organisatieontwerp.nl/codeaudit/ #informatiebeveiliging #python #appsec #cybersecurity

The quality of modern #Python software relies heavily on the effective use of static code analysis tools. Never trust, always verify! So use the #FOSS #SAST #tool #Python #Code Audit - github.com/nocomplexity... #pythonbrasil #hw_ioNL2025 #appsec #owasp #pycon #PyTorchCon #infosec

We believe that #security testing of #Python code should be carried out more and to a higher standard — but it should also be extremely #simple for everyone to perform. Anyone should be able to run a #SAST test quickly and easily. github.com/nocomplexity... #infosec #pycon #owasp #appsec #cybersec

#Python #Code Audit includes the most comprehensive collection of #security rules for verifying secure use of Python Standard Library functions. #free #free #free to use, it’s #oss #GPLisBack Never #trust #python #modules, #verify #it github.com/nocomplexity... #PyCon #owasp

#Python Under Fire: Hidden #Security Risks Spot vulnerabilities with Python Code Audit, a SAST tool that makes securing your #Python #code easy and effective. See nocomplexity.com/python-secur... #BHEU #appsec #owasp #infosec #Pycon #TallinnDigitalSummit #PyConAfrica #UDallas #SREcon25

Google’s CodeMender: More Dangerous Than Helpful? nocomplexity.com/google-codem... #infosec #google #security #cybersecurity #appsec #sast

#Static Application #Security #Testing (#SAST) is a security methodology that analyzes an application’s source code and artifacts (designs). Advantage of SAST for #Python is automation. But do not fall for the #AI hype. nocomplexity.com/ai-sast-scan... #owasp #appsec #infosec #ml #eff #foss #gpl

Cyclomatic complexity is a software metric used to indicate the complexity of a program. #secure software is #simple software. Check security and #complexity for #python #software with #python #code #audit github.com/nocomplexity... #infosec #appsec #owasp #cyber #ai #oss

Most security tools only check KNOWN #vulnerabilities. But #security scanning must be done on code! This to find #Python #code like: import builtins b = builtins b.exec("2+2") Python Code Audit finds vulnerabilities in your #Python code: github.com/nocomplexity... #appsec #owasp #infosec #trust

Goodbye Bandit, Hello Python Code Audit nocomplexity.com/stop-using-b... Stop Relying on Bandit->There’s a Better Way! #pythonprogramming #infosec #owasp #python #cybersecurty #appsec #auditnow #PyTorch #ai #openai #ml #Grok #fsf #gpl #RiseAndFall

SAST: The Secret to #Secure Python #Apps nocomplexity.substack.com/p/sast-the-s... Python Code Audit - nocomplexity.com/codeaudit/ application security testing (#SAST) tool #designed for #Python programs. #infosec #vulnerability #CyberSecurity #appsec #owasp #oss #ossf #fsfe #gpl

The #python Connection.recv() method unpickles the #data it receives, which can be a #security risk. #python #Code #audit checks on the multiprocessing Connection.recv() in #python code. Static application #security #testing (SAST) is a must do! github.com/nocomplexity... #owasp #infosec #cve

Using #Python TarFile.extractall or TarFile.extract is #dangerous Assume all input is #malicious. Use nocomplexity.com/codeaudit/ #cve #infosec #cybersecurity #owasp #ai #ml #appsec

#python dynamic imports are a potential #security issues. Use: importlib.import_module() This offers a better way to handle dynamic imports. Avoid using __import__ Do a #sast check on the code you use. Use the #free tool nocomplexity.com/codeaudit/ #vulnerability #infosec #owasp #ransomware

Guidance on End-to-End Email #Security, #Code does not lie , #Secure #Boot bypasses and more! Check #Open Security News nocomplexity.com/open-securit... #infosec #CyberSecurity #owasp #HybridPetya #Google

Never use #python pickle.load() or pickle.loads() on data received from an untrusted source. Use #python #code #audit to check your code. See github.com/nocomplexity... #infosec #cyber #security #sasr #owasp #appsec

How to do a SAST test? A Static Application #Security Test on #Python code is essential for security. It’s also a #shift-left practice that can help you to avoid serious security #incidents. Check nocomplexity.com/documents/co... #owasp #oss #psf #infosec #devopssec #ssdlc #audit #gpl

#python os.system : executing OS things can be malware. so test on clowns! from os import system as clown clown('hack.now -la') #code #audit finds this #clown, so make sure you do #security #testing with github.com/nocomplexity... #opensource #free #validate #cybersecutity #infosec

import builtins b = builtins b.exec("2+2") Obfuscating usage of builtin #python calls… #Python #code #audit will find it! use nocomplexity.com/codeaudit/ to find #security issues in Python code #cybersecurity #infosec #sast #owasp #cwe #cve #risk #malware

#Code does not lie! #Transparency helps to improve #cybersecurity. #Security by obscurity is generally a bad security practice. Use github.com/nocomplexity...

The use of the #python marshal can give #security issues. The marshal module is not intended to be secure against erroneous or #maliciously constructed data. Use Python Code Audit nocomplexity.com/codeaudit/ #infosec #owasp #cyber

When base encoding and #decoding is implemented, care should be taken not to introduce #vulnerabilities to buffer overflow attacks, or other attacks on the implementation. Use #python #code #audit nocomplexity.com/codeaudit/ We check on #Base64 use.