6 Essential Python Security Practices Every Developer Should Follow

1. Never Hard‑Code API Keys and Sensitive Credentials

API keys and secret credentials should be stored in a .env file and loaded with load_dotenv() . Example:

<code># .env
API_KEY = "YOUR API KEY"

from dotenv import load_dotenv
import os

load_dotenv()
API_KEY = os.getenv("API_KEY")
</code>

In your Python code, reference API_KEY . Always add the .env file to .gitignore to keep it out of version control.

2. Use Virtual Environments

Virtual environments add an extra layer of safety for Python projects and keep the development environment tidy, preventing library conflicts and isolating malicious packages.

3. Implement Input Validation and Sanitization

User input is a major attack surface. Validate and clean inputs to prevent injection attacks. Example using Pydantic:

<code>from pydantic import BaseModel, Field

class UserInput(BaseModel):
    username: str = Field(min_length=3, max_length=50, regex="^[a-zA-Z0-9_]+$")
</code>

Define strict rules for acceptable input characters and lengths, balancing security with usability.

4. Secure File Handling

Unrestricted file uploads can lead to directory traversal and attacks. Store files outside the web root and use safe temporary storage.

<code>import os

def is_safe_filename(filename):
    return filename.isalnum() and filename.endswith(('.png', '.jpg', '.txt'))

if is_safe_filename(user_filename):
    with open(os.path.join("uploads", user_filename), "wb") as f:
        f.write(user_file_data)
</code>

5. Encrypt Sensitive Data

Always encrypt data both in transit and at rest. Use libraries such as cryptography and ensure HTTPS for transmission.

Why it matters: Encryption prevents unauthorized access even if data is intercepted.

How to implement: Use the cryptography library and HTTPS.

<code>from cryptography.fernet import Fernet

key = Fernet.generate_key()
cipher_suite = Fernet(key)
cipher_text = cipher_suite.encrypt(b"Sensitive data")
</code>

6. Use Proper Exception Handling

Correctly handling exceptions aids debugging and prevents leaking sensitive information through stack traces.

Why it matters: Unhandled exceptions can expose code logic and data.

How to implement: Use try‑except blocks and log errors securely.

<code>try:
    # code that may raise an exception
except SomeSpecificException as e:
    # handle specific exception
except Exception as e:
    # handle general exception
    logging.error(f"An error occurred: {e}")
</code>