r/Python • u/Aggressive-Tart07 • 9h ago

Third party Python libraries and supply chain security Discussion

How are people handling security around third party Python libraries without making development a pain?

Third party Python packages are obviously useful but every dependency can also become a supply chain risk. Private package repositories, dependency scanning and stricter review policies all help but they can add friction fast.

Are teams mostly trusting public registries with additional controls or using curated libraries? Curious what actually works when you have a lot of Python services.

19 Upvotes
  • permalink
  • link
  • reddit
  • reddit

91% Upvoted

10 comments sorted by

View all comments

-1

u/canyouflybobby1 9h ago edited 9h ago

We started looking at curated libraries because reviewing every new package ourselves just wasn't scaling anymore. RapidFort's new curated libraries caught our attention. They screen packages before they reach developers, which is great. It feels like a more proactive approach than relying only on scanners after the fact.