Secure Coding Guide for Python
summary
OpenSSF-backed Secure Coding Guide maps concrete CWE entries to runnable Python snippets and currently contains about 70–80 compact examples, one 47-line case demonstrates CWE 410 insufficient resource pools: a non-compliant version spawns a new thread per message and can be hammered with ~10,000 messages into CPU saturation, the compliant version uses a ThreadPoolExecutor with max_workers and 1s timeout to bound concurrency and returns unfinished futures, examples note which static analyzers (e.g. Bandit) detect each issue and which do not.
AI-written summary · about
chapters (6)
- 0:00Introduction to the guide
- 3:34Demonstration of CWE-410
- 8:37Reviewing the repository
- 9:43Call for contributions
- 11:03Discussion on coding topics
- 17:13Analysis and conclusion
related talks
23mSecure Code, Safe Future: Mastering Security in Critical Software Development
34mSecure Python Development: Tips, Tricks, and Tools
48mSecure C++ Programming
26mTesting Python Security
59mCommon Python Coding Mistakes
54mPython Security Best Practices Against Vulnerabilities
47mFootguns and factorisation: how to make users of your cryptographic library successful
45mPython common security mistakes in 2022