How to Run Untrusted Python Code Without Getting Hacked

Running third-party or unknown Python code is one of the fastest ways to introduce serious risk onto your system. A single malicious package, a compromised dependency, or a script that quietly escalates privileges can lead to data loss, credential theft, or full system compromise.

This cheat sheet gives you a practical checklist of the must-do and should-do actions before you install or execute any Python program.

Follow these steps reduces your exposure to supply-chain attacks, privilege escalation, and unintended data leakage.

Important: This is only a quick-reference summary. More crucial information like threat models, secure coding patterns, tooling recommendations, and detailed guidelines is available in Python Security Handbook.

Securely Using a Python Program • Key principles before running unknown / third-party code

Install only from official repos: PyPI, conda, conda-forge. Never from random sites/forums. Understand the code & origin before running.

Scan with a well-maintained open-source Python SAST tool before execution. Avoid code that raises unexplained warnings.

Run inside venv / conda. Isolate from system. Never run as Administrator / root.

Prefer packages installable via pip/conda only. Avoid manual system-library installs unless inside a VM, container, or jail.

Python is not a sandbox. Use VM / container. Limit CPU, network, storage, file access. No access to system folders, USB, or cloud.

Choose free & open-source (incl. dependencies). Source availability enables independent audit. Avoid closed-source / mystery scripts.

Look for a Python Code Audit Badge (or similar). Ask: Which SAST tool? Can they share a report?

pip list --outdated → pip install --upgrade. Only update from trusted repositories.

Back up important data before running new code. If anything looks suspicious → disconnect from the network immediately.

Distrust programs relying on unverifiable external services or third-party auth.

Skip tools that collect usage data without full transparency — privacy & risk concerns.

Check packages for known vulnerabilities. SBOMs raise awareness but do not guarantee safety.

Check last commit, open issues / PRs. At least yearly functional validation expected.

Look for security.md / security.txt. Private reporting channel required. Never report vulns publicly before a fix.

Do a safe Online Audit of a PyPI package!

python -m venv .venv && source .venv/bin/activate pip install <pkg> # only from trusted index pip list --outdated pip install --upgrade <pkg>

Install and use Python Code Audit:

pip install -U codeaudit

Based on Python Security Handbook • CC-BY-SA-4.0 • Always prefer isolation & least privilege

Security is never black and white. Help with improving Python Code Audit and its documentation, and make Python security more accessible for everyone.

Join the community and help build the most complete, local-first Python security audit scanner.