# pyupio/safety

Safety checks Python dependencies for known security vulnerabilities and suggests the proper remediations for vulnerabilities detected.

Repository: https://github.com/pyupio/safety
Canonical: https://ross.abutalabs.com/products/safety
Homepage: https://safetycli.com/product/safety-cli
Language: Python
License Family: other
Topics: python, security, security-vulnerability, travis, vulnerability-scanners, vulnerability-detection, cicd, dependency-management, devsecops, open-source-security, package-management
Last push: 2026-08-20T18:27:57+00:00

## Health v2 (maintenance only)
Score: 94/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 98, release rhythm 86, longevity 100
- inputs: {"age_days": 3605, "days_push": 13, "days_rel": 96, "gap_med": 21, "n_releases_24m": 20}
- flags: no_license
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1995, forks 203 (observed 2026-08-28T04:06:03.455323+00:00)

## What it is
Safety CLI is a Python dependency vulnerability scanner that detects packages with known vulnerabilities and malicious packages in local development, CI/CD, and production environments. It provides actionable remediation recommendations, can auto-update requirements files, and integrates with CI pipelines via a GitHub Action.

## Use cases
- scan python requirements.txt for known vulnerabilities
- check pip dependencies for CVEs in CI
- find malicious python packages in my environment
- generate SBOM for python project dependencies
- auto-upgrade vulnerable packages to fixed versions
- run dependency security scan in github actions

## When to choose
- you need a dedicated Python dependency vulnerability scanner with remediation suggestions
- you want CI/CD integration via GitHub Actions or JSON/SBOM/HTML output
- you need malicious package detection and system-wide scans beyond a single lockfile

## When to avoid
- you need multi-language SCA (Java/JavaScript) without a paid Safety platform subscription
- you require fully offline scanning with no account or proprietary database dependency
- you want a permissively licensed tool - the repo has no open license and full features are commercial

## Facets
- artifact type: cli-tool
- maturity: active
- function: security, vulnerability-scanning, dependency-audit, cli, ci-cd
- domain: security, developer-tools
- platform: python, cli, cross-platform
- tags: python-dependencies, sca, software-supply-chain, vulnerability-database, sbom, malicious-packages, python, devops

## Member repositories
- pyupio/safety (main) score 94

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:06:03.455323+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T03:02:31.413893+00:00, confidence not recorded.
  - readme: https://github.com/pyupio/safety (fetched 2026-08-28T04:06:03.455323+00:00, sha 70e55b5051e1)
  - homepage: https://safetycli.com/product/safety-cli (fetched 2026-08-29T10:42:22.276248+00:00, sha 5f2a9e158786)
  - site_page: https://www.getsafety.com/about (fetched 2026-08-29T10:42:22.291913+00:00, sha 0767fa310e2a)
  - registry_pypi: https://pypi.org/pypi/safety/json (fetched 2026-08-29T10:42:22.295518+00:00, sha 57f45dc277ba)
  - site_page: https://www.getsafety.com/firewall (fetched 2026-08-29T10:42:22.285627+00:00, sha 2e9c166fa771)
  - site_page: https://www.getsafety.com/pricing (fetched 2026-08-29T10:42:22.287724+00:00, sha bc43419912d0)
  - site_page: https://www.getsafety.com/integrations (fetched 2026-08-29T10:42:22.289805+00:00, sha 4944838bfa5f)
  - site_page: https://www.getsafety.com/sign-up (fetched 2026-08-29T10:42:22.293753+00:00, sha 9b965e34ec29)
- Data as of 2026-08-30T08:39:29.467469+00:00.