Repolode
Submit
pyupio

pyupio/safety

A Python dependency vulnerability scanner that checks packages for known security issues and malicious packages, with remediation suggestions.

View on GitHubWebsite
Stars
2,002
Forks
210
Open issues
96
Last commit
2 days ago

What is it?

Safety CLI scans Python dependencies for packages with known security vulnerabilities and malicious packages. It can run in local development environments, CI/CD pipelines, and production systems, and reports findings with recommendations for fixing them.

The tool can scan individual requirements files or whole project directories. It can also automatically update requirements files to secure versions where they are available, following project policy settings. Output is available as text, JSON, SBOM, or HTML, and it integrates with CI/CD systems including GitHub Actions.

The core vulnerability data comes from the project's Safety DB. The project is MIT licensed, and some features such as system-wide scans and full vulnerability coverage are offered through the commercial Safety product.

Key features

  • 01Scans Python dependencies for known vulnerabilities and malicious packages.
  • 02Scans individual requirements files or entire project directories.
  • 03Can automatically update requirements to secure versions where available.
  • 04Outputs results as text, JSON, SBOM, or HTML.
  • 05Integrates with CI/CD pipelines, including GitHub Actions.

Use cases

  • Checking a Python project's dependencies before release.
  • Blocking vulnerable packages in CI/CD pipelines.
  • Auditing the software bill of materials for Python applications.

Quick start

  1. 1

    Install Safety with pip

    pip install safety
  2. 2

    Log in or register when prompted

    safety auth
  3. 3

    Run your first scan in a project directory

    safety scan

Things to know

  • Requires creating an account or logging in to run scans.
  • The free plan is limited to a single user and is not recommended for commercial use.
  • Full vulnerability database coverage requires a paid plan.

In collections

Security scanners, audits & threat intel tools

Topics

#python#security#vulnerability-scanner#dependency-management#devsecops#supply-chain-security#cicd#open-source-security#package-management#security-vulnerability

FAQ

What is safety?
A Python dependency vulnerability scanner that checks packages for known security issues and malicious packages, with remediation suggestions. Safety CLI scans Python dependencies for packages with known security vulnerabilities and malicious packages. It can run in local development environments, CI/CD pipelines, and production systems, and reports findings with recommendations for fixing them.
Is safety free to use? What license does it have?
safety has no declared license. Its code is public, but without a license you have no explicit permission to reuse it; ask the author before relying on it.
Is safety still maintained?
Actively maintained. The last commit to safety was on Nov 5, 2026.
What can I use safety for?
Checking a Python project's dependencies before release. Blocking vulnerable packages in CI/CD pipelines. Auditing the software bill of materials for Python applications.
How do I install safety?
Install Safety with pip: pip install safety Log in or register when prompted: safety auth Run your first scan in a project directory: safety scan
Where can I get safety?
The source code and installation instructions are on GitHub: https://github.com/pyupio/safety

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects