roboco/docs/rag/standards/python-security.md

Python Security Standards

No Hardcoded Secrets

NEVER hardcode secrets:

# Bad - NEVER
API_KEY = "sk-abc123xyz789"
DATABASE_URL = "postgresql://user:password@host/db"

# Good - environment variables
from pydantic_settings import BaseSettings

class Settings(BaseSettings):
    api_key: str
    database_url: str
    model_config = {"env_prefix": "ROBOCO_"}

SQL Injection Prevention

NEVER use string concatenation for SQL:

# Bad - SQL injection vulnerability
query = f"SELECT * FROM users WHERE id = '{user_id}'"

# Good - parameterized query
result = await session.execute(
    select(User).where(User.id == user_id)
)

Command Injection Prevention

NEVER pass user input directly to shell:

# Bad - command injection
import os
os.system(f"process_file {filename}")

# Good - use subprocess with list
import subprocess
subprocess.run(["process_file", filename], check=True)

No eval() or exec()

NEVER use on untrusted input:

# Bad - code injection
result = eval(user_input)

# Good - safe parsing
import ast
result = ast.literal_eval(user_input)  # Only literals

Non-Security Hashes

When hashing for non-security purposes:

import hashlib

content_hash = hashlib.md5(
    content.encode(),
    usedforsecurity=False  # Required flag
).hexdigest()[:12]

Security Tools

Run before merge:

# Security scan
uv run bandit -r roboco/ -ll

# Dependency audit
uv run pip-audit