Python security code review

When it applies

You're reading Python source (a repo, a PR, a service). This is the language-specific companion to code-review-methodology — the exact sinks and framework gotchas to grep and trace.

Why it works

Most severe Python bugs come from a known set of sinks plus framework misuse. Grep the sinks, trace each argument to a user source, and check the framework's safe-vs-unsafe API was used.

Sinks & patterns (grep, then trace to user input)

• Command exec: os.system, subprocess.*(..., shell=True), os.popen — shell=True + user input = injection.
• Code eval: eval, exec, pickle.loads, yaml.load (without SafeLoader), marshal — deserialization/eval RCE.
• SQL: raw/f-string queries, .raw(), .extra(), cursor.execute("... %s" % x) — use params, not formatting.
• SSRF: requests.get/urllib/httpx on a user URL (→ web-ssrf).
• Path/upload: open/send_file/os.path.join with user paths (traversal); zip extraction (zip-slip).
• Template (SSTI): render_template_string, Jinja from user input (→ web-ssti).
• Secrets: hardcoded keys/passwords; DEBUG=True in prod.