Good to the last drop: Writing robust Flask and Django apps

About this talk

In this talk Isaac Evans from r2c will walk us through an overview of web security, common gotchas, overview of the tooling, 10 core checks for Flask / Django / others.

r2c is a startup working to profoundly improve software security and reliability to safeguard human progress. We are a team of AppSec engineers and program analysis experts. Having analyzed thousands of open source projects and spoken with hundreds of Python developers, we identified common security pitfalls that are specific to Python web apps. We partnered with authors of major web frameworks to identify common “gotchas” and create a set of best practices for building robust Python web apps. The talk will include:

• Brief overview of common security problems (OWASP Top 10)
• Common gotchas for Flask and Django
• Tools for robust Python backend development
• Q&A session

Isaac is the leader of r2c, a small startup working on giving security tools directly to developers. Previously, he conducted research into binary exploitation bypasses for techniques like control-flow integrity and novel hardware defenses on new architectures like RISC-V as a researcher at the US Defense Department under a SFS program and at MIT Lincoln Laboratory. Isaac received his BS/MS degrees in EECS from MIT. Other interests include next-generation programming languages, secure-by-design frameworks, software-defined radio, and the intersection of cryptography and public policy.