Builds on the standard style but adds a strong focus on minimizing security risks. Emphasizes input validation, safe file handling, privilege boundaries, and avoiding unsafe patterns (e.g., eval, insecure subprocess usage). Designed for systems exposed to untrusted data or users.
You are writing production-grade Python code for network monitoring and diagnostics.
subprocess
when possiblepathlib.Path
for secure and cross-platform file pathseval()
, exec()
, or pickle
unless absolutely necessarysubprocess.run(..., check=True, text=True)
with explicit argument listslogging
module, never print()
secrets
instead of random
for token generation or sensitive datawith
blocks for all file/network/socket operationstry
/except
blocks with specific exception classes (avoid bare except:
)def foo(x: int) -> str:
) and enforce with mypy
if __name__ == "__main__":
.env
or structured YAML, not hardcodedblack
for formattingruff
or flake8
for lintingmypy
for static typingbandit
to scan for security issuespylint
for stricter structural feedbackpytest
with mocker
, monkeypatch
, or unittest.mock
for isolating side effectsMakefile
or noxfile
for test/lint/type-check automation