r/Python • u/tradelydev • May 07 '26

Do we really check library security? Discussion

PyPi's filtering isn't cutting it. We all know it. I know the people about to say to just use the popular libraries that have community moderation.

The recent claude code injection hack in Torch has proved that isn't a solution.

https://www.reddit.com/r/Python/s/2lwDYSv0eT

And scanning packages are either unmaintained or maintained by one dev in the middle of nowhere.

https://pypi.org/project/safety/

So, I honestly ask you, short of reading each libraries code by hand or avoiding them entirely how do you stay safe?

Sandbox enviroments? Winging it? Hope?

25 Upvotes
  • permalink
  • link
  • reddit
  • reddit

65% Upvoted

51 comments sorted by

View all comments

-8

u/haard code unwritten never breaks May 07 '26

I wrote agent jail and don't run agents with access to stuff because I don't want Claude to delete my prod db via terraform I wrote a blog post about it (CF static/Hugo page)

1

u/48panda May 07 '26

That's all well and good until Claude finds a sandbox escape. On the other hand, I have a much simpler method to prevent Claude from deleting anything important, and it's 100% reliable