first commit

Author: nocomplexity

README.md

@@ -0,0 +1,62 @@
+# Python Security Handbook
+
+**A practical, no-nonsense guide to writing secure Python code in 2026 and beyond.**
+
+![Python](https://img.shields.io/badge/Python-3776AB?logo=python&logoColor=white)
+![License](https://img.shields.io/github/license/nocomplexity/pythonsecurity)
+![Stars](https://img.shields.io/github/stars/nocomplexity/pythonsecurity)
+
+This open-source book covers **Python Security Fundamentals** with a strong focus on real-world practices, essential security tools, and actionable security recipes.
+
+## What You'll Learn
+
+- Core security principles every Python developer should know
+- How to secure common Python patterns and libraries
+- Secure coding techniques 
+- Essential open-source security tools for Python
+- Practical **security recipes** – step-by-step solutions to common security challenges
+- Dependency management, supply chain security, and runtime protection
+- Static Application Security Testing (SAST) and Software Composition Analysis (SCA)
+
+
+## Key Features
+
+- **Fundamentals First** – Clear explanations of weaknesses, vulnerabilities, and threats
+- **Practical Recipes** – Ready-to-use, secure code patterns
+- **Tool Recommendations** – Focused on the best Free and Open Source (FOSS) tools
+- **Realistic Advice** – Balanced between theory and production reality
+- **Regularly Updated** – Keeping pace with the evolving Python and security landscape
+
+
+## Tools Featured
+
+- **[Python Code Audit](https://github.com/nocomplexity/codeaudit)** – Best-in-class open-source Python SAST scanner
+- Dependency scanners (pip-audit, uv, etc.)
+- And other essential security tools
+
+## How to Read This Book
+
+You can read the book online at:  
+👉 **[https://nocomplexity.github.io/pythonsecurity/](https://nocomplexity.github.io/pythonsecurity/)**
+
+## Contributing
+
+Contributions are welcome! See [CONTRIBUTING.md](CONTRIBUTING.md) for details.
+
+Simple ways to help:
+- Star the repository
+- Share with fellow Python developers
+- Report issues or suggest improvements
+- Submit pull requests for new recipes or corrections
+
+## License
+
+This book is licensed under **CC-BY 4.0** – you are free to share and adapt with attribution.
+
+---
+
+**Made with ❤️ to [Simplify Cyber Security](https://nocomplexity.com/simplifysecurity-manifesto/) Challenges**
+
+Want to support the project? Consider [sponsoring](sponsors.md) or making a [donation](contribute.md).
+```
+

_static/cover_securitybydesign.jpg

@@ -0,0 +1,21 @@
+/* Minor css adjustments for the book-theme - Jupyter Book 2 - Not perfect as adjusting style is still in development for JupterBook2! */
+.text-blue-800 {
+  --tw-text-opacity: 1;
+  color: #ff0000;
+}
+
+.text-gray-600 {
+  --tw-text-opacity: 1;
+  color: #ff0000;
+}
+
+.text-gray-500 {
+  --tw-text-opacity: 1;
+  color: black;
+}
+
+a.button, button.button, cite.button a, span.button {
+  white-space: nowrap;
+  --tw-bg-opacity: 1;
+  background-color: #ff0000;
+}

_static/nocxstyle.css

@@ -0,0 +1,21 @@
+/* Minor css adjustments for the book-theme - Jupyter Book 2 - Not perfect as adjusting style is still in development for JupterBook2! */
+.text-blue-800 {
+  --tw-text-opacity: 1;
+  color: #ff0000;
+}
+
+.text-gray-600 {
+  --tw-text-opacity: 1;
+  color: #ff0000;
+}
+
+.text-gray-500 {
+  --tw-text-opacity: 1;
+  color: black;
+}
+
+a.button, button.button, cite.button a, span.button {
+  white-space: nowrap;
+  --tw-bg-opacity: 1;
+  background-color: #ff0000;
+}

_static/nocxstyle2026.css

@@ -0,0 +1,162 @@
+# About NO|Complexity
+
+> Trust in security software is not only about the software itself, but also about the people and their beliefs. People's core principles do shape software and communities around it. 
+
+## Who is Behind NO|Complexity?
+
+[NO|Complexity.com](https://nocomplexity.com/) is dedicated to solve business IT challenges in a rapidly evolving world. I’m Maikel Mardjan, and I believe that many business IT solutions are overly complex. Simple solutions have many advantages. But creating simple solutions is not simple. Tackling complexity challenges requires an unique combination of expertise, skills and people.
+
+
+With extensive experience across multiple architecture disciplines — including IT Architect, Security Architect, Business Architect, and Enterprise Architect — I have helped numerous organisations design secure and resilient IT systems with a strong emphasis on simplicity and practicality.
+
+I hold two Master’s degrees: an MSc in Business Studies from the University of Groningen and an MSc in Electrical Engineering from Delft University of Technology. I am also TOGAF 9 Certified and hold the CISSP (Certified Information Systems Security Professional) certification.
+
+Finding genuinely capable security professionals is not primarily about collecting industry certifications or academic qualifications. What truly matters is practical, **hands-on experience**. In cybersecurity, one of the most valuable traits is the ability to keep learning. While technologies, tools, and industry hypes constantly evolve, the **fundamental principles of information security have remained remarkably consistent over the past three decades.**
+
+
+Currently, I lead initiatives at [NO|Complexity.com](https://nocomplexity.com/), an innovative IT company focused on straightforward solutions based in the Netherlands.
+
+
+Certifications such as ISO 27001 and other industry-mandated standards play an important role in establishing structure and governance. However, they do not, by themselves, protect your information or systems.
+
+True information security is delivered by skilled people supported by effective open source tools and processes. Certifications and standards are helpful frameworks, but they are **not a substitute** for experienced professionals who understand the real-world challenges of securing complex Python (and other) environments.
+
+
+I created **[Python Code Audit](https://nocomplexity.com/codeaudit/)** because I believe existing tools fall short of what modern Python security demands. Python powers an enormous range of applications. From web services and data science to automation and AI and has become one of the most widely used programming languages in the world.
+
+In the security industry, we often use complex terminology around risks, processes, and metrics. There is frequently a lack of transparency, and too much reliance on opaque, difficult-to-maintain security products.
+
+I strongly believe that good cybersecurity tools should be **open source**, ideally under the GPL licence. While open source is not a guarantee of superiority over commercial solutions, genuine security begins with **trust**. Real Open source tools offer full transparency. You can inspect exactly how they work, what they detect, and their limitations.
+
+A single tool will never solve all cybersecurity challenges. Effective security is always a combination of good tools, robust processes, and skilled people.
+
+I am an active member of [OWASP](owasp.org), a community where security professionals collaborate to share knowledge, experiences, and practical solutions with the goal of making our digital world safer.
+
+
+
+
++++{"no-pdf": true}
+
+## Other NO|Complexity Publications
+
+### Cyber Security 
+
+% Start cards grid
+::::{grid} 1 1 2 3
+
+:::{card}
+:link: https://nocomplexity.com/codeaudit
+:header: 😀 **Python Code Audit**        
+
+Modern Python source code security analyser. A local-first, FOSS tool that makes security checks simple for everyone.
+:::
+
+
+:::{card}
+:link: https://nocomplexity.com/documents/securityarchitecture/introduction.html
+:header: 🤩 **Open Security Reference Architecture**        
+Cyber security can still be simple and effective.
+Use this Playbook to create better and faster security solutions for your security use case.
+:::
+
+:::{card}
+:link: https://nocomplexity.com/documents/securitybydesign/intro.html
+:header: 😋 **Security By Design**        
+
+Security by design is a proven method to develop products that are less vulnerable for cyber security threats.
+Master the topic quickly with this eBook.
+:::
+
+:::{card}
+:link: https://nocomplexity.com/documents/securitysolutions/intro.html
+:header: 🙃 **Open Security Solutions**        
+
+Given the vast array of FOSS cybersecurity products available, this publication offers a handcrafted curated selection.
+:::
+
+:::{card}
+:link: https://nocomplexity.com/documents/reports/SimplifySecurity.pdf
+:header: 😻 **Simplify Cyber Manifest**        
+
+A manifesto to revolutionize cybersecurity through simplification.
+:::
+
+
+:::{card}
+:link: https://nocomplexity.com/documents/simplifysecurity/intro.html#
+:header: 😉 **Simplify Security**        
+
+Find open simple cyber solutions that work. Simplify cyber security to accelerate its effectiveness.
+:::
+
+
+:::{card}
+:link: https://nocomplexity.com/documents/simplifyprivacy/intro.html
+:header: 😀 **Simplify Digital Privacy**        
+This digital Playbook is all about protecting *your* digital privacy.
+:::
+
+::::
+% End of Cards grid
+
+### Machine Learning - AI and Tools
+
+% Start cards grid
+::::{grid} 1 1 2 3
+
+
+:::{card}
+:link: https://nocomplexity.com/documents/fossml/abstract.html
+:header: 🥸 **Free and Open Machine Learning**        
+
+Freedom to control machine learning and AI technology is not self-evident. This Playbook gives you full control.
+:::
+
+
+:::{card}
+:link: https://nocomplexity.com/documents/jupyterlab/intro.html
+:header: 🤓 **Mastering JupyterLab**        
+
+Supercharge your data science journey with Mastering JupyterLab. Use this Playbook to streamline your workflow and boost productivity. 
+:::
+
+
+:::{card}
+:link: https://nocomplexity.com/documents/pythonbook/introduction.html
+:header: 😋 **Master Python for AI/ML**        
+
+Python programming skills are essential for architects, engineers, and even managers in the IT industry. 
+Become a Python master to do more with AI/ML applications.
+:::
+ 
+::::
+% End of Cards grid
+
+
+### General
+
+% Start cards grid
+::::{grid} 1 1 2 3
+
+
+:::{card}
+:link: https://nocomplexity.com/documents/arplaybook/introduction.html
+:header: 😎 **Architecture Playbook**        
+
+A playbook providing practical tools to help create architectures and designs more quickly and effectively. 
+:::
+
+:::{card}
+:link: https://nocomplexity.com/simplifyit/
+:header: 😲 **Simplify IT**        
+
+This is an eBook with proven scientific tools and frameworks to help you effectively solve complex IT problems and gain a comprehensive understanding of IT systems in a business context.
+:::
+
+
+::::
+% End of Cards grid
+
+
++++ 
+% End of part that will not be shown in PDF - automatic transform will not work - status May 2026 -

aboutnocx.md

@@ -0,0 +1,50 @@
+---
+title: Key Definitions and Python Security Terms
+short_title: Definitions
+---
+
+
+Clear and consistent terminology is essential in cybersecurity. However, the industry often suffers from hype, overlapping definitions, and vendor-specific jargon. In this book, the following definitions are used for precision and clarity within the Python security context.
+
+## Core Python Packaging Terms
+
+**Import Package**  
+An import package is a Python module (or collection of modules) that can be imported using the `import` statement.
+
+**Distribution Package**  
+A distribution package is a versioned archive of software that can be installed using tools such as `pip`. It is often synonymous with a “project” on PyPI. Distribution packages typically consist of one or more import packages (modules) bundled together.
+
+> **Security Note**: Every distribution package contains code — either pure Python modules or extensions written in other languages (e.g., C, C++, Rust, or Go). From a security perspective, **all dependencies**, both direct and transitive, should be regularly scanned for vulnerabilities. 
+
+**Python Module**  
+A Python module is a single `.py` file (or compiled equivalent) containing Python code that can be imported into other programs.
+
+**Python Library**  
+The term “library” has no strict formal definition in Python. It is commonly used interchangeably with “module” or “package”. The **Python Standard Library** is the best-known example of a Python library.
+
+**Python Standard Library (PSL)**  
+The Python Standard Library is the collection of modules and packages included with every standard Python installation. It provides broad functionality for common tasks (file I/O, networking, cryptography, data processing, etc.), making Python a “batteries-included” language. While generally robust, certain functions within the PSL can introduce security weaknesses depending on how they are used.
+
+**Standard Python Module**  
+A module that is included with the default Python distribution as part of the Python Standard Library. Although these modules undergo extensive review, some APIs can still lead to vulnerabilities (e.g., unsafe use of `eval()`, `pickle`, or XML parsers). Static Application Security Testing (SAST) is recommended to identify and mitigate such risks in your codebase.
+
+## Security Concepts
+
+**Weakness**  
+A condition in software, firmware, hardware, or a service that, under certain circumstances, could contribute to the introduction of a vulnerability. A weakness is not necessarily exploitable on its own.
+
+**Vulnerability**  
+An exploitable weakness. A vulnerability is a specific flaw that an attacker can leverage to cause harm, such as unauthorised access, data leakage, or remote code execution.
+
+**Threat**  
+An external event, actor, or action that has the potential to exploit a vulnerability. It represents the intent or mechanism of harm.
+
+**Advanced Persistent Threat (APT)**  
+An Advanced Persistent Threat occurs when an attacker successfully compromises a network, establishes a long-term presence on one or more systems, and extracts data over an extended period. Some APTs eventually reveal themselves through destructive actions (e.g., WannaCry ransomware or Stuxnet), but most aim to remain undetected for as long as possible.
+
+**Static Application Security Testing (SAST)**  
+SAST is a white-box security testing methodology that analyses source code, documentation, and design artefacts for potential security weaknesses without executing the program. In Python projects, SAST tools scan code for risky patterns such as unsafe use of `eval()`, insecure deserialisation, or improper input validation.
+
+**Software Composition Analysis (SCA)**  
+SCA is the process of identifying and evaluating the security risks associated with open-source and third-party dependencies in a project. While valuable, SCA is limited by the fact that many vulnerabilities in dependencies remain unreported or undiscovered. SCA should therefore be treated as one layer within a broader security strategy, not a complete solution.
+

appendices/definitions.md

@@ -0,0 +1,18 @@
+---
+title: References
+short_title: References
+---
+
+
+This section provides key resources that are particularly valuable when developing secure Python applications.
+
+## Official Python Documentation
+
+- **[Python Security Considerations](https://docs.python.org/3/library/security_warnings.html)**  
+  The official Python documentation that summarises important security considerations and known risks for modules in the Python Standard Library (PSL). Every serious Python SAST tool should align with these warnings.
+
+## Additional Recommended References
+
+- **[Simplify Python – References](https://nocomplexity.com/documents/pythonbook/generatedfiles/overview.html#references)**  
+  A carefully curated, free, and openly licensed (CC-BY) collection of high-quality references for professional Python developers.
+