#557: Security of everything at PyCon 2026
Show notes
Security has always been the vegetables of software. Everyone agrees it matters, and somehow it never quite makes it onto the plate. At PyCon US this year, that changed. For the first time ever, security got its own dedicated, day-long track, one of just two at the whole conference, sitting right next to AI. And the room was packed to the back wall.
On this episode, I'm joined by the three people at the center of it. Seth Larson, Security Developer in Residence at the Python Software Foundation and, very recently, a CPython core developer. Juanita Gomez, a PhD researcher at UC Santa Cruz in open source security, who co-chaired the track. And Mike Fiedler, PyPI's Safety and Security Engineer, one of the very few people paid full-time to keep the packages you install safe.
We use the arc of the track's talks to take the temperature of Python security right now: supply chain attacks, dependency cooldowns, zero trust, SBOMs, and the push to bring Rust into CPython. And why not one of us thinks security is anywhere close to solved. Turns out that's the good news. It's why the room was full.
Episode sponsors
Sentry Error Monitoring, Code talkpython26
Talk Python Courses
Links from the show Guests
Juanita Gomez: linkedin.com
Mike Fiedler: miketheman.dev
Seth Michael Larson: sethmlarson.dev
Trailblazing Python Security: us.pycon.org
Everything Security at PyCon US 2026 (PSF blog): pyfound.blogspot.com
Dependency Cooldowns: cooldowns.dev
Anatomy of a Phishing Campaign (Mike Fiedler) Recording: www.youtube.com
FedRAMP: www.gsa.gov
Zero Trust in 200ms: Implementing Identity-Per-Transaction with Python & Serverless-Tristan McKinnon: www.youtube.com
Rust for CPython project: blog.python.org
pre-PEP: discuss.python.org
Rust for CPython: Making Python Safer and More Robust for Everyone - Emma Smith: www.youtube.com
SBOMit: github.com
Asleep at the Wheel: Getting your SBOMs to pay attention... - Sanchit Sahay, Abhishek Reddypalle: www.youtube.com
Volatility: volatilityfoundation.org
Post Incident Runtime SBOM Generation from Python Memory - Hala Ali: www.youtube.com
zizmor: docs.zizmor.sh
GitHub Actions security in Python packages (Andrew Nesbitt write-up): nesbitt.io
andrew/pycon: data & analysis for the GitHub Actions security talk: github.com
GitHub Actions Security in Python Packages - Andrew Nesbitt: www.youtube.com
gh-profiler: examine a GitHub user's profile to gauge their contributions: github.com
PyCon US YouTube channel: www.youtube.com
SBOMit: adding verification to SBOMs (OpenSSF): openssf.org
Ecosystems: ecosyste.ms
Watch this episode on YouTube: youtube.com
Episode #557 deep-dive: talkpython.fm/557
Episode transcripts: talkpython.fm
Theme Song: Developer Rap
🥁 Served in a Flask 🎸: talkpython.fm/flasksong
---== Don't be a stranger ==---
YouTube: youtube.com/@talkpython
Bluesky: @talkpython.fm
Mastodon: @[email protected]
X.com: @talkpython
Michael on Bluesky: @mkennedy.codes
Michael on Mastodon: @[email protected]
Michael on X.com: @mkennedy
On this episode, I'm joined by the three people at the center of it. Seth Larson, Security Developer in Residence at the Python Software Foundation and, very recently, a CPython core developer. Juanita Gomez, a PhD researcher at UC Santa Cruz in open source security, who co-chaired the track. And Mike Fiedler, PyPI's Safety and Security Engineer, one of the very few people paid full-time to keep the packages you install safe.
We use the arc of the track's talks to take the temperature of Python security right now: supply chain attacks, dependency cooldowns, zero trust, SBOMs, and the push to bring Rust into CPython. And why not one of us thinks security is anywhere close to solved. Turns out that's the good news. It's why the room was full.
Episode sponsors
Sentry Error Monitoring, Code talkpython26
Talk Python Courses
Links from the show Guests
Juanita Gomez: linkedin.com
Mike Fiedler: miketheman.dev
Seth Michael Larson: sethmlarson.dev
Trailblazing Python Security: us.pycon.org
Everything Security at PyCon US 2026 (PSF blog): pyfound.blogspot.com
Dependency Cooldowns: cooldowns.dev
Anatomy of a Phishing Campaign (Mike Fiedler) Recording: www.youtube.com
FedRAMP: www.gsa.gov
Zero Trust in 200ms: Implementing Identity-Per-Transaction with Python & Serverless-Tristan McKinnon: www.youtube.com
Rust for CPython project: blog.python.org
pre-PEP: discuss.python.org
Rust for CPython: Making Python Safer and More Robust for Everyone - Emma Smith: www.youtube.com
SBOMit: github.com
Asleep at the Wheel: Getting your SBOMs to pay attention... - Sanchit Sahay, Abhishek Reddypalle: www.youtube.com
Volatility: volatilityfoundation.org
Post Incident Runtime SBOM Generation from Python Memory - Hala Ali: www.youtube.com
zizmor: docs.zizmor.sh
GitHub Actions security in Python packages (Andrew Nesbitt write-up): nesbitt.io
andrew/pycon: data & analysis for the GitHub Actions security talk: github.com
GitHub Actions Security in Python Packages - Andrew Nesbitt: www.youtube.com
gh-profiler: examine a GitHub user's profile to gauge their contributions: github.com
PyCon US YouTube channel: www.youtube.com
SBOMit: adding verification to SBOMs (OpenSSF): openssf.org
Ecosystems: ecosyste.ms
Watch this episode on YouTube: youtube.com
Episode #557 deep-dive: talkpython.fm/557
Episode transcripts: talkpython.fm
Theme Song: Developer Rap
🥁 Served in a Flask 🎸: talkpython.fm/flasksong
---== Don't be a stranger ==---
YouTube: youtube.com/@talkpython
Bluesky: @talkpython.fm
Mastodon: @[email protected]
X.com: @talkpython
Michael on Bluesky: @mkennedy.codes
Michael on Mastodon: @[email protected]
Michael on X.com: @mkennedy