I don't know what a "real security audit" is in this context but I think I shared enough pain (with links) from my personal perspective to give a head start I suppose.
I agree security is always context dependent but "passes untrusted input through a package built in C which takes over a year to make security releases when the changelog already references those" makes the set of contexts in which something passes the test very small
One better alternative is presumably the Rust crate (mentioned in the article) it just happens that there's no Python bindings available for that.
I agree security is always context dependent but "passes untrusted input through a package built in C which takes over a year to make security releases when the changelog already references those" makes the set of contexts in which something passes the test very small
One better alternative is presumably the Rust crate (mentioned in the article) it just happens that there's no Python bindings available for that.