python-wrap is a library of decorators that you wrap around your own code. It has no runtime dependencies, opens no sockets and reads no files, but a defect in a decorator such as timeout, rate_limit or validate_args can still weaken the code around it. Reports are taken seriously and answered.

Do not open a public issue.

Report privately by either route:

• Preferred: open a private advisory on GitHub.
• Email: pythondeveloper6@gmail.com, with python-wrap security in the subject.

Please include the version of python-wrap and Python, what an attacker gains, and the smallest reproduction you can manage.

This is a small project maintained by volunteers. If you have not heard back in a week, please chase: it means the message was missed, not ignored. You will be credited in the advisory and changelog if you wish. There is no bug bounty.

Security fixes are released as a new patch of the latest minor version. Older minors are not backported.

Supported Python versions: 3.10 to 3.14.

In scope: a decorator that fails to enforce what its documentation promises in a way that has security impact (a rate limit or circuit breaker that can be bypassed, a cache that leaks results between callers that should not share them, a validation decorator that accepts what it documents as rejected, a denial of service from unbounded memory growth in a documented-bounded structure).

Out of scope: behaviour documented as such, and findings from an automated scanner with no demonstrated impact.