# pypa/pip-audit

Audits Python environments, requirements files and dependency trees for known security vulnerabilities, and can automatically fix them

Repository: https://github.com/pypa/pip-audit
Canonical: https://ross.abutalabs.com/products/pip-audit
Homepage: https://pypi.org/project/pip-audit/
Language: Python
License: Apache-2.0
License Family: permissive
Topics: security, security-audit, python, pip, supply-chain
Last push: 2026-08-20T16:08:53+00:00

## Health v2 (maintenance only)
Score: 83/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 98, release rhythm 55, longevity 100
- inputs: {"age_days": 1826, "days_push": 13, "days_rel": 84, "gap_med": 190, "n_releases_24m": 4}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1354, forks 124 (observed 2026-08-28T04:04:28.697354+00:00)

## What it is
pip-audit is a command-line tool that scans Python environments, requirements files, and dependency trees for packages with known security vulnerabilities, using the PyPI JSON API and OSV as vulnerability data sources. It can also emit CycloneDX SBOMs and automatically fix vulnerable dependencies with the --fix flag.

## Use cases
- scan my python environment for vulnerable packages
- audit requirements.txt for known CVEs
- generate a CycloneDX SBOM for my python project
- automatically upgrade dependencies with security vulnerabilities
- run a dependency security check in CI
- check pip installed packages against OSV database

## When to choose
- you need to audit Python dependencies for known vulnerabilities locally or in CI
- you want SBOM generation in CycloneDX format
- you want automatic remediation of vulnerable pinned dependencies
- you need machine-readable output (JSON) for security pipelines

## When to avoid
- you need to audit non-Python ecosystems like npm or cargo
- you need continuous runtime monitoring rather than point-in-time scanning
- you require an air-gapped scanner without access to PyPI or OSV services

## Facets
- artifact type: cli-tool
- maturity: active
- function: security, vulnerability-scanning, dependency-audit, cli, developer-tools
- domain: security, developer-tools
- platform: cli, python, cross-platform
- tags: pip, vulnerability-scanning, sbom, cyclonedx, supply-chain-security, ci-cd, python, supply-chain

## Member repositories
- pypa/pip-audit (main) score 83

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:04:28.697354+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T04:42:03.851964+00:00, confidence not recorded.
  - readme: https://github.com/pypa/pip-audit (fetched 2026-08-28T04:04:28.697354+00:00, sha f1ca5372f527)
  - homepage: https://pypi.org/project/pip-audit/ (fetched 2026-08-29T12:00:26.524953+00:00, sha 7da85196adde)
  - registry_pypi: https://pypi.org/pypi/pip-audit/json (fetched 2026-08-29T12:00:26.528180+00:00, sha dcc9d18f04df)
- Data as of 2026-08-30T08:39:29.467469+00:00.