# Safety | Check Your Installed Dependencies For Known Security Vulnerabilities

**URL:** <https://onehack.st/t/safety-check-your-installed-dependencies-for-known-security-vulnerabilities/108366>\
**Category:** Tools & Scripts\
**Tags:** hacking, privacy\
**Created:** [September 13, 2020, 3:03pm UTC](https://onehack.st/t/safety-check-your-installed-dependencies-for-known-security-vulnerabilities/108366 "2020-09-13T15:03:08Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Prometheus](https://onehack.st/user_avatar/onehack.st/prometheus/32/34950_2.png) [@Prometheus](https://onehack.st/u/Prometheus)\
**Post date:** [September 13, 2020, 3:03pm UTC](https://onehack.st/t/safety-check-your-installed-dependencies-for-known-security-vulnerabilities/108366/1 "2020-09-13T15:03:08Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/3/b/3b2f02ae446cf0d473e9b1b0844466f4152874c9.png)

Safety checks your installed dependencies for known security vulnerabilities.  
By default it uses the open Python vulnerability database [Safety DB](https://github.com/pyupio/safety-db), but can be upgraded to use [pyup.io](http://pyup.io)’s [Safety API](https://github.com/pyupio/safety/blob/master/docs/api_key.md) using the `--key` option.

**Installation**  
Install `safety` with pip. Keep in mind that we support only Python 3.5 and up. Look at _Python 2.7_ section at the end of this document.

```auto
pip install safety

```

**Usage**  
To check your currently selected virtual environment for dependencies with known security vulnerabilites, run:

```auto
safety check

```

You should get a report similar to this:

```auto
+==============================================================================+| || /$$$ /$ || /$ __$ | $ || /$$$$ /$$$ | $__ //$$$ /$$$ /$ /$ || /$ _____/ |____ $| $$ /$ __$|_ $_/ | $ | $ || | $$$ /$$$$| $_/ | $$$$ | $ | $ | $ ||____ $ /$ __$| $ | $_____ / | $ /$| $ | $ || /$$$$/| $$$$| $ | $$$$ | $$/| $$$$ || | _______/_______ /| __/_______ / ___/____ $ || /$ | $ || | $$$/ || by pyup.io ______ / || |+==============================================================================+| REPORT |+==============================================================================+| No known security vulnerabilities found. |+==============================================================================+

```

Now, let’s install something insecure:

```auto
pip install insecure-package

```

_Yeah, you can really install that._  
Run `safety check` again:

```auto
+==============================================================================+| || /$$$ /$ || /$ __$ | $ || /$$$$ /$$$ | $__ //$$$ /$$$ /$ /$ || /$ _____/ |____ $| $$ /$ __$|_ $_/ | $ | $ || | $$$ /$$$$| $_/ | $$$$ | $ | $ | $ ||____ $ /$ __$| $ | $_____ / | $ /$| $ | $ || /$$$$/| $$$$| $ | $$$$ | $$/| $$$$ || | _______/_______ /| __/_______ / ___/____ $ || /$ | $ || | $$$/ || by pyup.io ______ / || |+==============================================================================+| REPORT |+==========================+===============+===================+===============+| package | installed | affected | source |+==========================+===============+===================+===============+| insecure-package | 0.1.0 | <0.2.0 | changelog |+==========================+===============+===================+===============+

```

**Examples**

**Read requirement files**  
Just like pip, Safety is able to read local requirement files:

```auto
safety check -r requirements.txt

```

**Read from stdin**  
Safety is also able to read from stdin with the `--stdin` flag set.  
To check a local requirements file, run:

```auto
cat requirements.txt | safety check --stdin

```

or the output of `pip freeze` :

```auto
pip freeze | safety check --stdin

```

or to check a single package:

```auto
echo "insecure-package==0.1" | safety check --stdin

```

_For more examples, take a look at the [options](https://github.com/pyupio/safety#options) section._

**Using Safety in Docker**  
Safety can be easily executed as Docker container. It can be used just as described in the [examples](https://github.com/pyupio/safety#examples) section.

```auto
echo "insecure-package==0.1" | docker run -i --rm pyupio/safety safety check --stdincat requirements.txt | docker run -i --rm pyupio/safety safety check --stdin

```

**Using the Safety binaries**  
The Safety [binaries](https://github.com/pyupio/safety/releases) provide some [extra security](https://pyup.io/posts/patched-vulnerability/).  
After installation, they can be used just like the regular command line version of Safety.

**Using Safety with a CI service**  
Safety works great in your CI pipeline. It returns a non-zero exit status if it finds a vulnerability.  
Run it before or after your tests. If Safety finds something, your tests will fail.  
**Travis**

```auto
install: - pip install safetyscript: - safety check

```

**Gitlab CI**

```auto
safety: script: - pip install safety - safety check

```

**Tox**

```auto
[tox]envlist = py37[testenv]deps = safety pytestcommands = safety check pytest

```

**Deep GitHub Integration**  
If you are looking for a deep integration with your GitHub repositories: Safety is available as a part of [pyup.io](https://pyup.io/), called [Safety CI](https://pyup.io/safety/ci/). Safety CI checks your commits and pull requests for dependencies with known security vulnerabilities and displays a status on GitHub.

[https://github.com/pyupio/safety/raw/master/safety\_ci.png](https://github.com/pyupio/safety/raw/master/safety_ci.png)

**Using Safety in production**  
Safety is free and open source (MIT Licensed). The underlying open vulnerability database is updated once per month.  
To get access to all vulnerabilites as soon as they are added, you need a [Safety API key](https://github.com/pyupio/safety/blob/master/docs/api_key.md) that comes with a paid [pyup.io](https://pyup.io/) account, starting at $99 for organizations.

**Options**

**`--key`**  
_API Key for [pyup.io](http://pyup.io)’s vulnerability database. Can be set as `SAFETY_API_KEY` environment variable._  
**Example**

```auto
safety check --key=12345-ABCDEFGH

```

**`--db`**  
_Path to a directory with a local vulnerability database including `insecure.json` and `insecure_full.json`_  
**Example**

```auto
safety check --db=/home/safety-db/data

```

**`--proxy-host`**  
_Proxy host IP or DNS_

**`--proxy-port`**  
_Proxy port number_

**`--proxy-protocol`**  
_Proxy protocol (https or http)_

**`--json`**  
_Output vulnerabilities in JSON format._  
**Example**

```auto
safety check --json

```

```auto
[[ "django", "<1.2.2", "1.2", "Cross-site scripting (XSS) vulnerability in Django 1.2.x before 1.2.2 allows remote attackers to inject arbitrary web script or HTML via a csrfmiddlewaretoken (aka csrf_token) cookie.", "25701"]]

```

**`--full-report`**  
_Full reports include a security advisory (if available)._  
**Example**

```auto
safety check --full-report

```

```auto
+==============================================================================+| || /$$$ /$ || /$ __$ | $ || /$$$$ /$$$ | $__ //$$$ /$$$ /$ /$ || /$ _____/ |____ $| $$ /$ __$|_ $_/ | $ | $ || | $$$ /$$$$| $_/ | $$$$ | $ | $ | $ ||____ $ /$ __$| $ | $_____ / | $ /$| $ | $ || /$$$$/| $$$$| $ | $$$$ | $$/| $$$$ || | _______/_______ /| __/_______ / ___/____ $ || /$ | $ || | $$$/ || by pyup.io ______ / || |+==============================================================================+| REPORT |+============================+===========+==========================+==========+| package | installed | affected | ID |+============================+===========+==========================+==========+| django | 1.2 | <1.2.2 | 25701 |+==============================================================================+| Cross-site scripting (XSS) vulnerability in Django 1.2.x before 1.2.2 allows || remote attackers to inject arbitrary web script or HTML via a csrfmiddlewar || etoken (aka csrf_token) cookie. |+==============================================================================+

```

**`--bare`**  
_Output vulnerable packages only. Useful in combination with other tools._  
**Example**

```auto
safety check --bare

```

```auto
cryptography django

```

**`--cache`**  
_Cache requests to the vulnerability database locally for 2 hours._  
**Example**

```auto
safety check --cache

```

**`--stdin`**  
_Read input from stdin._  
**Example**

```auto
cat requirements.txt | safety check --stdin

```

```auto
pip freeze | safety check --stdin

```

```auto
echo "insecure-package==0.1" | safety check --stdin

```

**`--file` , `-r`**  
_Read input from one (or multiple) requirement files._  
**Example**

```auto
safety check -r requirements.txt

```

```auto
safety check --file=requirements.txt

```

```auto
safety check -r req_dev.txt -r req_prod.txt

```

**`--ignore` , `-i`**  
_Ignore one (or multiple) vulnerabilities by ID_  
**Example**

```auto
safety check -i 1234

```

```auto
safety check --ignore=1234

```

```auto
safety check -i 1234 -i 4567 -i 89101

```

**`--output` , `-o`**  
_Save the report to a file_  
**Example**

```auto
safety check -o insecure_report.txt

```

```auto
safety check --output --json insecure_report.json

```

**Review**  
If you save the report in JSON format you can review in the report format again.

**Options**

**`--file` , `-f` (REQUIRED)**  
_Read an insecure report._  
**Example**

```auto
safety check -f insecure.json

```

```auto
safety check --file=insecure.json

```

**`--full-report`**  
_Full reports include a security advisory (if available)._  
**Example**

```auto
safety review -r insecure.json --full-report

```

```auto
+==============================================================================+| || /$$$ /$ || /$ __$ | $ || /$$$$ /$$$ | $__ //$$$ /$$$ /$ /$ || /$ _____/ |____ $| $$ /$ __$|_ $_/ | $ | $ || | $$$ /$$$$| $_/ | $$$$ | $ | $ | $ ||____ $ /$ __$| $ | $_____ / | $ /$| $ | $ || /$$$$/| $$$$| $ | $$$$ | $$/| $$$$ || | _______/_______ /| __/_______ / ___/____ $ || /$ | $ || | $$$/ || by pyup.io ______ / || |+==============================================================================+| REPORT |+============================+===========+==========================+==========+| package | installed | affected | ID |+============================+===========+==========================+==========+| django | 1.2 | <1.2.2 | 25701 |+==============================================================================+| Cross-site scripting (XSS) vulnerability in Django 1.2.x before 1.2.2 allows || remote attackers to inject arbitrary web script or HTML via a csrfmiddlewar || etoken (aka csrf_token) cookie. |+==============================================================================+

```

**`--bare`**  
_Output vulnerable packages only._  
**Example**

```auto
safety review --file report.json --bare

```

```auto
django

```

**Python 2.7**  
This tool requires latest Python patch versions starting with version 3.5. We did support Python 2.7 in the past but, as for other Python 3.x minor versions, it reached its End-Of-Life and as such we are not able to support it anymore.  
We understand you might still have Python 2.7 projects running. At the same time, Safety itself has a commitment to encourage developers to keep their software up-to-date, and it would not make sense for us to work with officially unsupported Python versions, or even those that reached their end of life.  
If you still need to run Safety from a Python 2.7 environment, please use version 1.8.7 available at PyPi. Alternatively, you can run Safety from a Python 3 environment to check the requirements file for your Python 2.7 project.

## GitHub:

> **[GitHub - pyupio/safety: Safety checks Python dependencies for known...](https://github.com/pyupio/safety)**
>
> Safety checks Python dependencies for known security vulnerabilities and suggests the proper remediations for vulnerabilities detected.