flakehell VS safety

For existing projects, you can use the package flakehell with the baseline feature to report new violations since integrating a new linter will likely result in hundreds or even thousands of violations. This guide explains how to integrate flakehell and resolve violations over time.

Safety and Dependabot complement these security tools by focusing on external dependencies. Safety takes charge of examining your dependencies, ensuring they are up-to-date and free from any known vulnerabilities. Dependabot works similarly, scanning dependencies, verifying if they're current and assessing them for potential security flaws. This function is crucial as weaknesses in external dependencies can compromise the security of the entire codebase.

https://pyup.io/safety/ for security checks of dependencies

I'm trying this tool at the moment: https://pyup.io/safety/

Checking could be done if something like this eventually shows up in safety or pip-audit.

A 2021 security report by Snyk, states 47% of Python projects contain known vulnerabilities. On the bright hand side, almost 87% of known vulnerabilities can be resolved by upgrading the vulnerable package. Safety checks your installed dependencies for known security vulnerabilities.

safety: Safety checks your installed dependencies for known security vulnerabilities.

There is a python project called "safety". https://github.com/pyupio/safety If you run this after every package install or update and on a regular cadence it should catch the worst offenders much easier than having someone manually review every package.