Secure coding

Escape output: cross-site scripting

Think of a community noticeboard. If a note could run down the street and pick visitors' pockets, you'd want it behind glass. If a web page shows a comment exactly as typed, a commenter can type HTML. A <script> tag then runs in every visitor's browser, where it can steal their session. That's cross-site scripting (XSS), injection into a web page.

The fix is escaping, the glass: turning the characters that mean something in HTML into harmless codes, so the browser shows them as text:

import html

comment = '<script>steal(document.cookie)</script> Great tent!'
print(html.escape(comment))
print(html.escape('He said "5 < 6" & left'))

Escape at the moment you put text into HTML, every time. Web frameworks and template engines do this automatically. The danger comes when you build HTML strings yourself, or switch the automatic escaping off. Model output counts as user input here. A model that summarized a hostile web page can repeat a script tag word for word.

Passwords: slow, salted hashes

Never store passwords as they were typed. When (not if) a database leaks, every user's password leaks with it, and people reuse passwords everywhere.

Store a hash instead: a one-way function that turns a password into a fixed-size scramble. You can turn a cow into a burger, and never a burger back into a cow. To check a login, hash what was typed and compare. Two more details make it safe:

1. Salt. Add a random value, the salt, to each password before hashing, and store it with the hash. Then two users with the password "summer2026" get different hashes. An attacker can't use a precomputed table of common passwords.
2. Slow on purpose. A normal hash such as SHA-256 is built to be fast: billions per second on a graphics card. That's terrible for passwords, because attackers can guess quickly. Picture a lock that takes a second to try each key. You won't notice, and a burglar with a million keys gives up. Password hashes repeat the work many thousands of times, so each guess is expensive.

PBKDF2 repeats an HMAC (a keyed hash) thousands of times. The standard algorithms are Argon2, bcrypt, scrypt and PBKDF2. In real code use a library, such as argon2-cffi, bcrypt or hashlib.pbkdf2_hmac, with current settings: about 600,000 rounds for PBKDF2-SHA256. The academy's browser Python doesn't include those, so the example builds PBKDF2 from hmac with fewer rounds, purely to show how it works.

Finally, compare hashes with hmac.compare_digest, not ==. An ordinary comparison stops at the first different character, so its timing leaks how much of a guess was right. compare_digest always takes the same time.

import hmac, hashlib

def pbkdf2_sha256(password: bytes, salt: bytes, iterations: int) -> bytes:
    mac = hmac.new(password, digestmod=hashlib.sha256)
    def prf(data):
        m = mac.copy()
        m.update(data)
        return m.digest()
    u = prf(salt + b"\x00\x00\x00\x01")
    acc = int.from_bytes(u, "big")
    for _ in range(iterations - 1):
        u = prf(u)
        acc ^= int.from_bytes(u, "big")
    return acc.to_bytes(32, "big")

print(pbkdf2_sha256(b"password", b"salt", 1).hex())
print(pbkdf2_sha256(b"password", b"salt", 4096).hex())

Secrets, randomness and least privilege

Secrets are API keys, database passwords and signing keys. Treat them like house keys, and don't leave them under the mat.

• Keep them out of code and out of git. Read them from environment variables or a secret manager. Leaked keys on GitHub are found by bots within minutes.
• Keep them out of logs and error messages. Log "key ending in ...a9F2" if you must log anything.
• Rotate (replace) any key that may have leaked, at once. Deleting the commit isn't enough, because git history and copies remain.

Randomness for security comes from the secrets module: secrets.token_urlsafe(32) for reset links, secrets.token_bytes(16) for salts. The random module is predictable by design, so it's fine for games and shuffling, never for tokens.

Least privilege means giving each part only the access it needs. A cleaner gets keys to the offices, not to the safe. A reporting script gets a read-only database user. An AI agent that drafts emails gets no "send" tool. If the part is compromised or tricked, the damage stays small.

Dependencies are code you didn't write but run anyway. Pin versions, update them, and check for known flaws with tools like pip-audit. Watch for typosquatting, fake packages named one letter off a popular one, such as reqeusts.

The OWASP Top 10 is the industry's list of the most common web security risks. Read it once a year: injection, broken access control and misconfiguration are always near the top.

import secrets

token = secrets.token_hex(16)
print(len(token))