#557: Security of everything at PyCon 2026

Security has always been the vegetables of software. Everyone agrees it matters, and somehow it never quite makes it onto the plate. At PyCon US this year, that changed. For the first time ever, security got its own dedicated, day-long track, one of just two at the whole conference, sitting right next to AI. And the room was packed to the back wall.

On this episode, I'm joined by the three people at the center of it. Seth Larson, Security Developer in Residence at the Python Software Foundation and, very recently, a CPython core developer. Juanita Gomez, a PhD researcher at UC Santa Cruz in open source security, who co-chaired the track. And Mike Fiedler, PyPI's Safety and Security Engineer, one of the very few people paid full-time to keep the packages you install safe.

We use the arc of the track's talks to take the temperature of Python security right now: supply chain attacks, dependency cooldowns, zero trust, SBOMs, and the push to bring Rust into CPython. And why not one of us thinks security is anywhere close to solved. Turns out that's the good news. It's why the room was full.

Episode sponsors

Sentry Error Monitoring, Code talkpython26

Talk Python Courses

Links from the show Guests

Juanita Gomez: linkedin.com

Mike Fiedler: miketheman.dev

Seth Michael Larson: sethmlarson.dev

Trailblazing Python Security: us.pycon.org

Everything Security at PyCon US 2026 (PSF blog): pyfound.blogspot.com

Dependency Cooldowns: cooldowns.dev

Anatomy of a Phishing Campaign (Mike Fiedler) Recording: www.youtube.com

FedRAMP: www.gsa.gov

Zero Trust in 200ms: Implementing Identity-Per-Transaction with Python & Serverless-Tristan McKinnon: www.youtube.com

Rust for CPython project: blog.python.org

pre-PEP: discuss.python.org

Rust for CPython: Making Python Safer and More Robust for Everyone - Emma Smith: www.youtube.com

SBOMit: github.com

Asleep at the Wheel: Getting your SBOMs to pay attention... - Sanchit Sahay, Abhishek Reddypalle: www.youtube.com

Volatility: volatilityfoundation.org

Post Incident Runtime SBOM Generation from Python Memory - Hala Ali: www.youtube.com

zizmor: docs.zizmor.sh

GitHub Actions security in Python packages (Andrew Nesbitt write-up): nesbitt.io

andrew/pycon: data & analysis for the GitHub Actions security talk: github.com

GitHub Actions Security in Python Packages - Andrew Nesbitt: www.youtube.com

gh-profiler: examine a GitHub user's profile to gauge their contributions: github.com

PyCon US YouTube channel: www.youtube.com

SBOMit: adding verification to SBOMs (OpenSSF): openssf.org

Ecosystems: ecosyste.ms

Watch this episode on YouTube: youtube.com

Episode #557 deep-dive: talkpython.fm/557

Episode transcripts: talkpython.fm

Theme Song: Developer Rap

🥁 Served in a Flask 🎸: talkpython.fm/flasksong

---== Don't be a stranger ==---

YouTube: youtube.com/@talkpython

Bluesky: @talkpython.fm

Mastodon: @talkpython@fosstodon.org

X.com: @talkpython

Michael on Bluesky: @mkennedy.codes

Michael on Mastodon: @mkennedy@fosstodon.org

Michael on X.com: @mkennedy