GitHub now warns you about flaws affecting your Python code

Code repository will also offer admins fixes from the developer community

Python has joined Ruby and JavaScript on GitHub's list of coding languages it scans for security vulnerabilities.

Developers using Python can now get security alerts for any new bugs the code repository platform spots, as well as some recent vulnerabilities Python has had.

They will also find Python on their project dependency graph, which tracks all the projects, packages and applications a developer's code depends on without leaving their repository.

Security alerts will notify users of any known vulnerabilities affecting the code their repository relies on, and the dependency graph also lets users know if there's a known security fix from within the wider GitHub community.

GitHub, bought by Microsoft for $7.5 billion last month, tracked more than four million vulnerabilities in 500,000 Ruby and JavaScript code repositories after it shipped support for those languages last year.

Developers typically patched known vulnerabilities affecting their projects within seven days of detection, GitHub said, suggesting a similar approach for Python-based projects would be useful to users.

"We've chosen to launch the new platform offering with a few recent vulnerabilities," GitHub quality engineer Robert Schultheis said in a blog post.

"Over the coming weeks, we will be adding more historical Python vulnerabilities to our database. Going forward, we will continue to monitor the NVD feed and other sources, and will send alerts on any newly disclosed vulnerabilities in Python packages."

To enable Python security alerts, developers must first check in a requirements.txt file or Pipfile.lock file inside their public Python code repositories. Doing so will automatically enable the dependency graph and security alerts.

Private repositories require users to opt into security alerts via their settings, or by allowing access in the dependency graph section of the repository's 'Insights' tab.

Admins will then receive security alerts by default, and can add teams or individuals to the notifications via their settings page 'Alerts' tab.

Picture: Shutterstock

Featured Resources

Preparing for AI-enabled cyber attacks

MIT technology review insights

Download now

Cloud storage performance analysis

Storage performance and value of the IONOS cloud Compute Engine

Download now

The Forrester Wave: Top security analytics platforms

The 11 providers that matter most and how they stack up

Download now

Harness data to reinvent your organisation

Build a data strategy for the next wave of cloud innovation

Download now

Most Popular

UK gov considers blocking Nvidia's takeover of Arm
Acquisition

UK gov considers blocking Nvidia's takeover of Arm

4 Aug 2021
RMIT to be first Australian university to implement AWS supercomputing facility
high-performance computing (HPC)

RMIT to be first Australian university to implement AWS supercomputing facility

28 Jul 2021
Tesla Megapack goes up in flames at Australian battery site
Hardware

Tesla Megapack goes up in flames at Australian battery site

30 Jul 2021