Question 1

How do you run external commands with subprocess safely?

Accepted Answer

**Target Audience:** Developers who have used `os.system` or copied a `subprocess` line from the internet, and want to know what each argument does and why it matters.
**Difficulty:** Medium
**Python version:** Example 1 (`shlex`) was run on CPython 3.11 (python3.11 and the in-page Pyodide 0.25.1 runtime, CPython 3.11.3). Examples 2 and 3 start real processes, which a browser runtime cannot do, so they are shown with an "Open in playground" button and were run on python3.12 (identical output on

Question 2

What are common Python security pitfalls?

Accepted Answer

**Target Audience:** Developers who write Python services or scripts and want a concrete checklist; no security background assumed.
**Difficulty:** Medium
**Python version:** Examples 1 and 2 were run on CPython 3.11 (python3.11 and the in-page Pyodide 0.25.1 runtime, CPython 3.11.3). Example 3 needs `sqlite3` and the `tarfile` filters, which the page runtime does not have, so it was run on python3.12 (and gave identical output on python3.13).

> **How to read this doc:** Each idea is explained

Question 3

What is pickling and what are its risks?

Accepted Answer

**Target Audience:** Python developers who know the basics and want to understand serialisation and its security model
**Difficulty:** Medium
**Python version:** Behaviour checked on CPython 3.11, 3.12 and 3.13 (and in the page's Pyodide 3.11 runtime)

> **How to read this doc:** Each idea is explained in plain language first, then tagged with `📌 Interview term:` so you also learn the exact words an interviewer expects. Every output block in the **Verified** section was copied from a real run o

PYTHONDECODED.

Medium

How do you run external commands with subprocess safely?

What are common Python security pitfalls?

What is pickling and what are its risks?