python-web-app-security-audit

name	python-web-app-security-audit
description	Run defensive pre-release security tests for Python web applications. Use for FastAPI, Django, Flask, and ASGI services: the common interface between Python web apps and servers. Tests authentication, authorization, hostile input, headers, CORS, cookies, rate limits, errors, and configuration to return evidence-backed findings and clear test boundaries.
license	MIT
metadata	{"version":"1.1.0"}

Python Web App Security Audit

Run a configurable pytest suite against a local Python web application before release. It uses ASGI, the interface between a Python web app and its server, so the checks can exercise FastAPI, Django, Flask through an adapter, and comparable services without opening a public server.

Scope

The bundled checks cover authentication, authorization, input validation, response headers, CORS, cookies, rate limits, error handling, HTTP method handling, and unsafe configuration. Read setup and boundaries, framework adapters, route configuration, fixture safety, and assertion catalog before adapting the suite to an application.

Do not represent a passing run as a penetration test or proof of production security. The suite does not verify deployment TLS, a WAF, dependency vulnerabilities, external infrastructure, or controls it cannot reach through the configured test application.

Prepare the suite