nitpick VS safety

It can become tedious maintaining configurations across projects, especially since EditorConfig, pytest-cov, flake8, Mypy and pre-commit all require configuration files. Nitpick is a tool and flake8 plugin that enforces the same configurations across multiple language-independent projects, automating this tedious configuration.

I'd recommend you have a look at nitpick. It's a tool to align lint/formatting tools across projects.

Safety and Dependabot complement these security tools by focusing on external dependencies. Safety takes charge of examining your dependencies, ensuring they are up-to-date and free from any known vulnerabilities. Dependabot works similarly, scanning dependencies, verifying if they're current and assessing them for potential security flaws. This function is crucial as weaknesses in external dependencies can compromise the security of the entire codebase.

https://pyup.io/safety/ for security checks of dependencies

I'm trying this tool at the moment: https://pyup.io/safety/

Checking could be done if something like this eventually shows up in safety or pip-audit.

A 2021 security report by Snyk, states 47% of Python projects contain known vulnerabilities. On the bright hand side, almost 87% of known vulnerabilities can be resolved by upgrading the vulnerable package. Safety checks your installed dependencies for known security vulnerabilities.

safety: Safety checks your installed dependencies for known security vulnerabilities.

There is a python project called "safety". https://github.com/pyupio/safety If you run this after every package install or update and on a regular cadence it should catch the worst offenders much easier than having someone manually review every package.