The Future of Python Security: Trends, Challenges, and Solutions

<p>How is the Python ecosystem adapting to the modern landscape of software security and supply chain defense? This week on the show, we sit down with Seth Larson, the Python Software Foundation’s Security Developer in Residence.</p>
<p>Seth shares his background in open source and how he got involved in security engineering. We discuss the Python Security Response Team and how a recent PEP formalized its processes for reporting and triage.</p>
<p>Seth breaks down how large language models are affecting vulnerability discovery and increasing the volume to triage. We also cover the security advantages of trusted publishing on PyPI, how Software Bill of Materials (SBOMs) under PEP 770 help track dependencies, and some advice on improving your CI/CD security.</p>
<div class="alert alert-primary" role="alert">
<p><strong>Course Spotlight:</strong> <a href="realpython.com/courses/testing-your-code-with-… Your Code With Python’s unittest</a></p>
<p>Learn how to use Python’s unittest framework to write unit tests for your code, including test cases, fixtures, and test suites.</p>
</div>
<div class="card mt-4 mb-4 bg-secondary">
<p class="card-header h3 text-center bg-body-tertiary">Free Bonus: <strong>Python Security Checklist</strong></p>
<div class="card-body">
<div class="container">
<div class="row">
<div class="col-xs-12 col-sm-4">
<p>Get a <strong>Python Security Checklist (PDF)</strong> and keep secrets, passwords, encryption, HTTPS, input validation, and dependency audits on one printable page:</p>
</div>
<div class="col-xs-12 col-sm-8 text-center">
<img class="img-fluid rounded mb-3 w-100" src="files.realpython.com/media/python-security-che…; alt="Python Security Checklist">
</div>
</div>
<div class="row mb-3">
<div class="col-12">

<form action="/optins/process/" method="post" class="mb-0">
<input type="hidden" name="slug" value="python-security-cheat-sheet">
<input type="hidden" name="version" value="594">
<input type="hidden" name="source_path" value="">

<div class="mb-3">
<input name="email" type="email" class="form-control form-control-lg" placeholder="Email Address" aria-label="Email Address" autocomplete="email" required>
</div>
<button name="submit" type="submit" class="btn btn-primary btn-lg w-100">Send My Python Security Checklist »</button>

</form>
</div>
</div>
</div>
</div>
</div>

<p>Topics:</p>
<ul>
<li>00:00:00 – Security Note: Python certifi package and PHP updates</li>
<li>00:00:37 – Introduction</li>
<li>00:02:22 – Pikmin fans unite!</li>
<li>00:02:51 – How did you get involved in security research?</li>
<li>00:07:07 – Security Research is unique and the wider community</li>
<li>00:13:35 – The influx of LLMs finding vulnerablities</li>
<li>00:17:18 – The Python Security Response Team and PEP 811</li>
<li>00:25:21 – Video Course Spotlight</li>
<li>00:26:44 – Is the flood of vulnerabilities unlimited?</li>
<li>00:29:15 – Security Track at PyCon US 2026</li>
<li>00:31:03 – Does a security engineer need humility?</li>
<li>00:33:25 – PEP770 Improving measurability of Python packages with Software Bill-of-Materials</li>
<li>00:38:55 – Communication across other languages and package repositories</li>
<li>00:41:41 – What’s it been like writing PEPs?</li>
<li>00:44:32 – Defining the term Trusted Publisher</li>
<li>00:47:27 – Differences between public and private vulnerabilities</li>
<li>00:51:19 – Are you using LLMs in your work as a security researcher?</li>
<li>00:52:56 – The fear/hype cycle of vulnerabilites and triaging reports</li>
<li>00:58:35 – Do you have security advice for developers?</li>
<li>01:03:12 – What are you excited about in the world of Python?</li>
<li>01:06:14 – What do you want to learn next?</li>
<li>01:08:08 – How can people follow your work online?</li>
<li>01:09:58 – Thanks and goodbye</li>
</ul>
<p>Show Links:</p>
<ul>
<li><a href="sethmlarson.dev/">Seth Larson - Website</a></li>
<li><a href="github.com/certifi/python-certifi/security/adv… of emSign root cerificate - Advisory - certifi/python-certifi</a></li>
<li><a href="realpython.com/python-supply-chain-security/&q… Chain Security for the Age of AI-Speed Exploits – Real Python</a></li>
<li><a href="pypi.org/project/urllib3/">urllib3 - PyPI</a></li>
<li><a href="python.org/psf/developersinresidence/">… Developers in Residence - Python.org</a></li>
<li><a href="youtube.com/watch?v=V9n2jmkeRf0&t=3s"…: Security Work isn’t Special - Seth Larson - OpenSSF Community Day</a></li>
<li><a href="youtube.com/watch?v=x9K3xPmi_tg">Phantom Dependencies: is your requirements.txt haunted? - Seth Michael Larson - YouTube</a></li>
<li><a href="youtube.com/watch?v=PtMysG7aAO0">PSF - Update from our Security Engineers - YouTube</a></li>
<li><a href="youtube.com/watch?v=RP5djmTSbCk">Python Security: What we’ve done, now AI & Glasswing are changing everything (Sponsor: Alpha-Omega) - YouTube</a></li>
<li><a href="youtube.com/watch?v=Xmr89QEr720">Learn… from the not-so-secret Python security “cabal” - Seth Michael Larson - YouTube</a></li>
<li><a href="peps.python.org/pep-0811/">PEP 811 – Defining Python Security Response Team membership and responsibilities</a></li>
<li><a href="peps.python.org/pep-0770/">PEP 770 – Improving measurability of Python packages with Software Bill-of-Materials</a></li>
<li><a href="sethmlarson.dev/pep-770-sbom-data-from-pypi-fe… 770 Software Bill‑of‑Materials (SBOM) data from PyPI, Fedora, and Red Hat — Seth Larson</a></li>
<li><a href="docs.pypi.org/trusted-publishers/">Tru… Publisher - Getting Started - PyPI Docs</a></li>
<li><a href="github.com/zizmorcore/zizmor">zizmor: Static analysis for GitHub Actions (and more)</a></li>
<li><a href="pikminwiki.com/">Pikipedia, the Pikmin wiki</a></li>
<li><a href="blog.python.org/2026/09/language-summit-2026-r… for CPython (Python Language Summit 2026) | Python Insider</a></li>
<li><a href="pyfound.blogspot.com/">Python Software Foundation News</a></li>
<li><a href="pythoninsider.blogspot.com/">Python Insider</a></li>
<li><a href="sethmlarson.dev/">Seth Larson - Website</a></li>
</ul>
<p>Level up your Python skills with our expert-led courses:</p>
<ul>
<li><a href="realpython.com/courses/cicd-github-actions/&qu… Continuous Integration and Deployment Using GitHub Actions</a></li>
<li><a href="realpython.com/courses/testing-your-code-with-… Your Code With Python's unittest</a></li>
<li><a href="realpython.com/courses/get-started-with-ollama… to Get Started With Ollama</a></li>
</ul> <p><a rel="payment" href="realpython.com/join">Support the podcast & join our community of Pythonistas</a></p>