Safety: Setup, Configuration, and Best Practices

Introduction to Dependency Safety

Modern software development relies heavily on open-source packages. While this accelerates development, it also introduces significant security risks. The safety tool is a command-line utility designed to check your installed Python dependencies for known security vulnerabilities.

What is Safety?

Safety is a Python package that checks your project dependencies against a curated database of known security vulnerabilities. It scans your environment or requirements files and alerts you if any installed packages have known Common Vulnerabilities and Exposures (CVEs).

Why Dependency Security Matters

Using compromised or vulnerable dependencies can lead to data breaches, unauthorized access, and application downtime. Attackers frequently target known vulnerabilities in popular libraries because they are easy to exploit and widely distributed. Automating the process of checking these dependencies ensures that you are not shipping vulnerable code to production.

Setup and Installation

Installing safety is straightforward. It is recommended to install it in your global environment or a dedicated virtual environment so it remains accessible across all your projects without interfering with your application dependencies.

pip install safety

Once installed, you can verify the installation by checking the version:

safety --version

Basic Usage and Configuration

Using safety involves running the check command. You can scan your current active environment or specific requirements files before you even install them.

Scanning the Current Environment

To scan all packages currently installed in your active Python environment, simply run the check command without any arguments:

safety check

If vulnerabilities are found, the tool will output a table detailing the package name, the installed version, the vulnerability ID, and a description of the security issue.

Scanning a Requirements File

It is often better to scan a requirements.txt file before installing dependencies to prevent introducing vulnerabilities in the first place. You can do this using the -r or --file flag:

safety check -r requirements.txt

Generating Reports

For integration into automated systems and CI/CD pipelines, you might need machine-readable output. Safety supports JSON and text output formats to make parsing easy.

safety check -r requirements.txt --json

You can also save the output directly to a file for auditing purposes and historical tracking:

safety check -r requirements.txt --output report.txt

Best Practices

To get the most out of safety, consider integrating it deeply into your development workflow rather than treating it as an afterthought.

• Integrate into CI/CD Pipelines: Add a safety check step to your continuous integration pipeline. Configure the pipeline to fail the build if any vulnerabilities are detected, preventing insecure code from being deployed.
• Use an API Key for Updated Databases: While the open-source database is helpful, registering for an API key on the Safety website provides access to a more frequently updated and comprehensive vulnerability database.
• Ignore with Caution: If a vulnerability does not affect your specific use case, you can ignore it using the --ignore flag followed by the vulnerability ID. However, document why you are ignoring it and review ignored vulnerabilities regularly.
• Scan Regularly: New vulnerabilities are discovered daily. Do not just scan once during project setup. Schedule regular scans or run them automatically whenever dependencies are updated.
• Combine with Other Tools: Safety focuses on known dependency vulnerabilities. Combine it with tools like bandit for static code analysis to create a comprehensive security posture.

Conclusion

Securing your application's supply chain is no longer optional in modern software development. By installing and configuring the safety tool, you add a crucial layer of defense against known dependency vulnerabilities. Integrating it into your local workflow and CI/CD pipelines ensures that your applications remain secure, robust, and trustworthy over time. Start scanning your projects today to take proactive control of your dependency security.