Top all-time · #9003
Safety
Company blog · pyup.io/postssecurityprogramming
Safety is the company blog at pyup.io, writing about security and programming. Since 2016, 8 different Hacker News readers have linked it 16 times, most often “Show HN: Automated Security and Dependency Updates for Python Projects”. No feed was found, so read it on the site itself.
Too few sampled comments (5) to say how often HN recommends it.?
Why HN links it
Safety, a pyup.io tool that checks Python dependencies for known vulnerabilities. Commenters mention it for flagging vulnerable packages, updates and Python 3 incompatibilities, and link its docs and posts.
Summarised by Claude from a sample of 5 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Safety gives security teams real-time visibility and governance over every AI tool, package, MCP server, and IDE extension across their developer fleet.
Most-linked posts?
- Show HN: Automated Security and Dependency Updates for Python Projects5 people · 6 mentions · first linked 2017-02-13
What Hacker News says?
I'm currently running https://pyup.io I wouldn't call it a success yet, but it is growing :)
Comment linking /
on “Ask HN: Successful one-person online businesses?”Submitted Analyzing Django requirement files on GitHub as a story · 143 points
HN discussionJust signed up and discovered a vulnerability. Thanks! A quick suggestion, consider adding a full sample configuration along with your config docs: https://pyup.io/docs/configuration/ It's a lot easier to see how it all sits together with a sample. CircleCI has a great example: https://circleci.com/docs/1.0/config-sample/
Comment linking /docs/configuration/
on “Operation Rosehub – patching thousands of open-source projects”Submitted Manage your Python dependencies with pyup.io as a story · 3 points
HN discussionI've built something like this for Python projects. You add your repo and a bot is constantly checking for insecure and/or outdated packages and sends you a pull request if you need to update. It's free for open source projects at https://pyup.io
Comment linking /
on “Operation Rosehub – patching thousands of open-source projects”Submitted Show HN: Automated Security and Regular Dependency Updates for Python Projects as a story · 3 points
HN discussion"bandit" (available in pypi) is a nice static analysis tool - I don't remember if it is able to recurse into dependencies though [safety]( https://pyup.io/safety/ ) is a commercial product that monitors your dependencies for this kind of shenanigans LGTM.com seemed to be working in this area - Semmle was acquired by github/microsoft
Comment linking /safety/
on “Two malicious Python libraries caught stealing SSH and GPG keys”Submitted Show HN: Automated Security and Dependency Updates for Python Projects as a story · 3 points
HN discussionIt already exists for Python: https://pyup.io/
Comment linking /
on “Ask HN: What's a side project you built to make money that hasn't?”Submitted Finding security vulnerabilities in third party packages as a story · 1 points
HN discussionThe best thing for me was starting https://pyup.io Working with developers is such a refreshing thing to do!
Comment linking /
on “Ask HN: What has been your most rewarding job or project and why?”Submitted Pyup: Get automatic pull requests when your dependencies get updated as a story · 1 points
HN discussionI just use pyup ( https://pyup.io/ ) for Python projects and it works like a charm. It not only show vulnerabilities but also updates and Python 3 incompatibilities.
Comment linking /
on “Apology after Japanese train departs 20 seconds early”Submitted Pipfiles and Docker as a story · 1 points
HN discussionHere is PyUp (safety) response: https://pyup.io/posts/patched-vulnerability/
Comment linking /posts/patched-vulnerability/
on “Building a backdoor with Node.js”Submitted Online Python requirements.txt Checker as a story · 1 points
HN discussion