By language
Security testing for Python applications and APIs.
Python underpins web apps (Django, Flask, FastAPI), data platforms, and AI backends. Template injection, unsafe deserialization, SSRF, and injection are the recurring application-layer risks to test.
Common Python pitfalls
Server-side template injection (e.g. in Jinja2 when user input reaches templates), unsafe pickle/YAML deserialization, SSRF, and SQL injection are frequent. Framework misconfiguration adds access-control gaps.
Framework focus
Django and FastAPI reduce many risks by default, but authorization logic and custom query building still need testing across roles.
Key risks to test
FAQ
What are common Python web security issues?
Server-side template injection, unsafe deserialization (pickle/YAML), SSRF, SQL injection, and access-control gaps in custom authorization logic are the most common Python application risks.
Impactr finds and proves whether flaws like this are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.