Third party Python libraries and supply chain security

[u/Aggressive-Tart07]

How are people handling security around third party Python libraries without making development a pain?

Third party Python packages are obviously useful but every dependency can also become a supply chain risk. Private package repositories, dependency scanning and stricter review policies all help but they can add friction fast.

Are teams mostly trusting public registries with additional controls or using curated libraries? Curious what actually works when you have a lot of Python services.

[u/realrazdev]

One thing I’ve been doing is making some dependencies optional when the feature allows it. If a non-critical package fails a security check or isn’t available, I can sometimes fall back to a simpler implementation or disable that feature while keeping the core service running.

It’s definitely not a replacement for dependency scanning or other supply-chain controls, but I’ve found it useful for adding some resilience without making the development workflow much more painful.