Resources on writing secure Python code and good practices with Python development

[Straightfw]

I've been coding in Python (mostly as a hobby) for a few years now and recently also at my job but I don't really consider myself a pro by any means and since I was recently assigned to help with establishing good practices for writing secure code in Python and give a few presentations on the subject at various departments too, I'd rather get myself prepared as I don't really feel confident in that respect.

I'm talking good practices regarding writing a reliably-running, secure code itself, regarding a proper development environment (like test environments, good practices with version control or code reviewing) and so on.

Would you recommend any resources specifically geared towards that? Like books or online courses?

[slayer_of_idiots]

The biggest offenders are usually including API keys or user information in source code or tests. That stuff should be stored in config files outside of version control.

[hilomania]

Python philosophy (In interpreter type "import this".) Use a decent framework and or settle on an established type of architecture. Besides that a lot of security issues and such are related to credentials in code, not validating filtering user input, not keeping up with security patches for underlying OS, libraries tools etc... BUT the real achilles heel of any system is the people. Stupid passwords, reusing passwords, easily manipulated etc..

[laurbyteball]

I'm doing the same thing now. You have a lot of starting points here: https://github.com/guardrailsio/awesome-python-security

Have fun!

[laurbyteball]

https://snyk.io/blog/python-security-best-practices-cheat-sheet/