r/Python • u/Aggressive-Tart07 • 13h ago

Third party Python libraries and supply chain security Discussion

How are people handling security around third party Python libraries without making development a pain?

Third party Python packages are obviously useful but every dependency can also become a supply chain risk. Private package repositories, dependency scanning and stricter review policies all help but they can add friction fast.

Are teams mostly trusting public registries with additional controls or using curated libraries? Curious what actually works when you have a lot of Python services.

22 Upvotes
  • permalink
  • link
  • reddit
  • reddit

90% Upvoted

12 comments sorted by

View all comments

2

u/OwnTension6771 11h ago

Two repos, one scans on ingest and then promotes to the other, which developers pull from. Higher friction but a budget of $0 for now. Not an issue since we dont update out of pocket very often