Python 3

Apply to security-supported CPython 3 minors, then included framework/library/platform prompts. Flag CPython 3.10 and older for upgrade: they are end of life (3.10.22 was final); these rules cannot compensate. Check standard-library default changes against every supported minor.

Baseline

• Distrust requests, files, archives, environment, command-line arguments, queues, databases, caches, and external services.
• Enforce boundary validation, authorization, and resource limits server-side even when callers validate.
• Prefer small documented allowlists over blocklists for operations, names, paths, algorithms, protocols, destinations.
• Run the newest patch of a supported CPython minor, or vendor security update for vendor-supplied Python; rebuild images on either change. CPython fixes ship only in new patches. Prefer minor-following images (e.g. python:<minor>-slim) rebuilt with docker build --pull, or bot-updated digests. Verify exact Dockerfile/.python-version/CI patches on python.org; otherwise use build-failing placeholders, never memory.
• Check CPython separately: dependency auditors like pip-audit miss interpreters. Scan images with OS/container scanners; follow deployed minors' python.org security announcements.
• Give services dedicated non-administrative OS identities with only needed file/network/process permissions.
• Type hints, dataclasses, assertions, and editor checks cannot validate runtime input.

Input

• Decode bytes with explicit encoding/error policy, never locale defaults for security-sensitive input.
• Decode security-sensitive Base64