---
paths:
  - "**/*.py"
  - "**/*.pyi"
---
# Python Security

> This file extends `common/security.md` with Python-specific content.

## Secret Management

```python
import os
from dotenv import load_dotenv

load_dotenv()

api_key = os.environ["OPENAI_API_KEY"]  # Raises KeyError if missing
```

## Security Scanning

Use the scanner already configured by the project. If Bandit is configured, run it through the project's environment manager, for example using the repository's equivalent of `bandit -r src/`.

Do not install a scanner or run an unbounded repository-wide command without checking project configuration first.

## Optional Skill

For Django or another security-sensitive framework, load a matching available skill when the current Pi session exposes one. Otherwise consult the project's pinned framework documentation and perform the review directly.