safety check

safety check --json

Analyze Python dependencies with Safety, detecting known vulnerabilities against the Safety database.

Run it in the Python project pipeline when you want dependency analysis with Safety: safety check queries the Safety vulnerability database with the installed packages (or the requirements file) and reports findings — packages with CVEs, severity, and fix version. It's the classic Python SCA: the pipeline check with the ecosystem's format. In Python DevSecOps, safety is the pipeline filter: a high-severity finding blocks the merge.

Don't use it as a complete analysis: safety covers the Safety database (package CVEs) — code vulnerabilities (SAST) are out of scope. The Safety database is updated (the free version with the public database, the commercial one with the full one): database coverage should be reviewed. And note: safety detects by package version — false positives from reachability need triage. For current open-source SCA, pip-audit (022) is the PyPA alternative; safety is the classic with its own database.