$ show pyupio/safety
Safety is a commercial CLI tool for software supply chain security, primarily scanning Python (and limited npm) dependencies for known vulnerabilities. It operates as a multi-command CLI built with Click and Typer, offering commands such as `scan`, `check`, `auth`, `firewall`, `init`, and `codebase`. The architecture is modular: a core scanning engine (`safety/scan/`) discovers dependency files (requirements.txt, pyproject.toml, Pipfile.lock, etc.), resolves packages, and matches them against a proprietary vulnerability database fetched from the Safety platform. Results are formatted via a pluggable formatter system (JSON, HTML, screen, text, SPDX) and can be uploaded to the platform for reporting. The tool also includes a firewall mode that intercepts pip/poetry/uv/npm install commands to block malicious packages in real time, using shell aliases (Unix) or registry/autorun (Windows). Authentication is multi-modal: OAuth2 (browser-based), API keys, and machine tokens, with a complex enrollment flow for enterprise MDM. An internal event bus (`safety/events/event_bus/bus.py`) provides async telemetry and audit trail emission, used throughout auth, init, and scan workflows. The codebase demonstrates strong engineering practices: layered configuration resolution (CLI > env > config file > default), a command wrapper pattern for package managers, and a policy file system (YAML) for ignoring vulnerabilities by severity, CVSS score, or expiration. However, there is notable technical drift: the legacy `check` and `license` commands are deprecated but still present, typing is incomplete in several modules, and the Windows firewall interceptor relies on fragile registry manipulation. The test suite is extensive but heavily mocks external services, making integration tests brittle. External dependencies include `httpx`, `authlib`, `tenacity`, `rich`, `pydantic`, `dparse`, `packaging`, `certifi`, `filelock`, and the proprietary `safety-schemas` package. The tool is distributed as a PyPI package and as a GitHub Action, with CI/CD pipelines building platform-specific binaries via PyInstaller and PyApp. Overall, Safety is a mature, feature-rich security tool with a well-architected core, though some areas show signs of rapid feature growth and legacy debt.
The LLM identified 4 files worth highlighting for reuse:
A thread-safe asynchronous event bus that allows subscribing handlers and dispatching events with optional metrics. It runs its own asyncio event loop in a background thread, enabling non-blocking telemetry emission without blocking the CLI. The pattern is cleanly isolated and could be extracted for any application needing async event handling in a synchronous context.
A generic directory scanner that recursively finds files matching configured patterns (e.g., requirements.txt, pyproject.toml) while respecting exclusion rules (directories, file patterns). It uses a handler mapping to process each found file. The logic is self-contained and reusable for any project needing to discover configuration or dependency files in a directory tree.
Implements typosquatting detection using edit distance (Levenshtein) with a DoS protection mechanism that limits the number of comparisons per package name. It compares package names against a curated list of popular packages. The algorithm is isolated, well-documented, and could be reused in any package manager or registry to detect malicious lookalike packages.
Provides TLS configuration resolution with a clear precedence chain: CLI options > environment variables > config file > system defaults. It creates an SSL context with optional custom CA bundle and hostname override. The pattern is a textbook example of layered configuration and is reusable in any Python application needing flexible TLS setup.