github-starred/awesome-python
2
0
Fork 0
mirror of https://github.com/vinta/awesome-python.git synced 2026-11-08 02:15:12 -06:00
Code Issues 461 Packages Projects Releases Wiki Activity

docs: add Betterleaks to Supply Chain Security intro

Browse Source 
Co-Authored-By: Claude <noreply@anthropic.com>
This commit is contained in:
Vinta Chen
2026-10-16 18:24:59 +08:00
co-authored by Claude
parent 550a5e81f6
commit 4143a9847c
1 changed files with 3 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
website/data/category_intros/supply-chain-security.md
+3
View File
@@ -4,9 +4,12 @@ How to choose:
- A project managed by uv: uv audit
- Environments, requirements files, and projects outside uv: pip-audit
- Leaked secrets in a repo's history or files: Betterleaks
`uv audit` comes with uv. Run it in your project, and it [audits the project's dependencies](https://docs.astral.sh/uv/reference/cli/#uv-audit) for known vulnerabilities and for statuses like deprecation and quarantine. By default, it covers every extra and dependency group.
pip-audit [scans Python environments for packages with known vulnerabilities](https://github.com/pypa/pip-audit), using the Python Packaging Advisory Database. Run `pip-audit` for the current environment, `pip-audit -r requirements.txt` for a requirements file, or `pip-audit .` for a local project. In CI, run it with its [official GitHub Action](https://github.com/pypa/pip-audit#github-actions). Only audit a requirements file you would install, since `pip-audit -r` is [functionally equivalent to `pip install -r`](https://github.com/pypa/pip-audit#security-model).
Betterleaks [scans git history, directories, and files for leaked secrets](https://github.com/betterleaks/betterleaks). Install it with Homebrew, Docker, or `go install`, then run `betterleaks git .` to scan your repository's full history. To catch a secret before it lands in a commit, add its [pre-commit hook](https://github.com/betterleaks/betterleaks/blob/main/docs/scanning.md#git), which scans staged changes and redacts the secrets it reports.
Also control what gets installed, since an audit only finds vulnerabilities someone has already reported. For requirements files, pip's docs recommend [hash-checking mode](https://pip.pypa.io/en/stable/topics/secure-installs/) to protect against remote tampering. In a uv project, uv's docs suggest a [dependency cooldown](https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns), which holds back new releases until the community has had a chance to vet them.