From fe7006edccca554d9f3176b1d05e5121827aa7f6 Mon Sep 17 00:00:00 2001 From: Vinta Chen Date: Sun, 16 Aug 2026 14:12:46 +0800 Subject: [PATCH] feat: add pip-audit, minting the Supply Chain Security section MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The PyPA-official dependency vulnerability scanner: 30.9M downloads/month (pepy; largely CI traffic, which is the use case), 1.3K stars, pushed 2026-08. Verified 2026 guidance names it the free baseline over the older commercial safety. Sole obvious choice. This mints the reform's first new section — an explicit maintainer override of decision 18 (all minted use cases are subcategories), accepted in the audit preview. TOC line, heading, and description ride this commit per the Build Backends pattern; placed alphabetically in the Security group. Co-Authored-By: Claude --- README.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/README.md b/README.md index fa7ebfff..f9c97614 100644 --- a/README.md +++ b/README.md @@ -116,6 +116,7 @@ An opinionated guide to the best Python frameworks, libraries, tools, and resour - [Cryptography](#cryptography) - [Penetration Testing](#penetration-testing) +- [Supply Chain Security](#supply-chain-security) - [Web Security](#web-security) **Other** @@ -1099,6 +1100,12 @@ _Frameworks and tools for penetration testing._ - [sherlock-project](https://github.com/sherlock-project/sherlock) - Hunt down social media accounts by username across social networks. - [social-engineer-toolkit](https://github.com/trustedsec/social-engineer-toolkit) - A toolkit for social engineering. +### Supply Chain Security + +_Tools for auditing dependencies against known vulnerabilities._ + +- [pip-audit](https://github.com/pypa/pip-audit) - Audits Python environments and dependency trees for known vulnerabilities, using the PyPI Advisory Database and OSV. + ### Web Security _Libraries for application-layer web security._