Safety CLI Documentation

Issues are classified into the following priority levels to determine resolution targets:

• Critical: Issues that break core functionality or pose significant security vulnerabilities.
• High: Significant bugs affecting many users with possible workarounds.
• Medium: Bugs affecting a smaller subset of users or those with simple workarounds.
• Low: Minor bugs or cosmetic issues.
• Enhancements: Improvements and new features scheduled according to the project roadmap and community input.

To access the latest vulnerability data (the free database is only synced once per month), you must obtain an API key via a subscription at safetycli.com.

Follow these steps to retrieve your key:

1. Sign Up: Visit safetycli.com and click sign up.
2. Start a Trial: Select a plan and start a 14-day free trial.
3. Access Account: After completing the signup/payment process, navigate to your account page.
4. Copy Key: Locate and copy your API key from your account homepage.

If an issue is not addressed within the expected timeframe defined in the SLA, you can escalate the matter using one of the following methods:

1. Tag the assignee: Tag the person currently assigned to the issue on GitHub.
2. Email support: Contact the engineering team at engineers@safetycli.com.

You can integrate Safety into your CI/CD pipelines using the official GitHub Action. This allows you to test your dependencies for vulnerabilities automatically during your workflow runs.

Full documentation for the action can be found at https://github.com/pyupio/safety-action.

To install Safety on your development machine, use pip to install the safety package.

pip install safety

Safety follows a Service-Level Agreement (SLA) for managing reported issues. While these are goals rather than hard promises, the following response time targets apply:

Response Times

• Initial Acknowledgment: Automated reply sent via GitHub Actions within minutes.
• First Human Response: Aim for 1-2 business days.
• Bug Triage: Aim for 3 business days to classify the issue.

Resolution Time Goals

• Critical Bugs: Within 5 business days.
• High-Priority Bugs: Within 10 business days.
• Medium-Priority Bugs: Within 20 business days.
• Low-Priority Bugs: Within 40 business days.
• Enhancements: Scheduled based on the project roadmap.

The SafetyContext is a singleton class used to hold the global state of a Safety command execution (e.g., command, subcommand, params, account, telemetry, etc.).

Because it uses SingletonMeta, calling SafetyContext() anywhere in your code will return the same instance, ensuring consistent configuration across different modules.

Key Attributes:

• command: The current command being run.
• params: A dictionary of command parameters.
• account: The authenticated account information.
• packages: List of scanned packages.
• ignore_vulns: Configuration for ignoring vulnerabilities.

class SafetyContext(metaclass=SingletonMeta):
    """
    A singleton class to hold the Safety context.
    """
    # ... attributes ...

The SafetyPlatformClient supports three distinct authentication modes via the AuthenticationType enum:

1. API Key (AuthenticationType.api_key): Uses a custom ApiKeyAuth that injects the X-Api-Key header into every request.
2. Machine Token (AuthenticationType.machine_token): Uses MachineTokenAuth, which implements Basic Authentication using the format machine_id:machine_token encoded in Base64. This is used for automated/machine environments.
3. OAuth2 Token (AuthenticationType.token): Uses an OAuth2Client (from authlib) to handle login flows, token refreshing (via the provided update_token callback), and standard API calls. This mode is used for user-centric authentication.

When Safety configures UV indexes (either in pyproject.toml or uv.toml), it uses the following logic for the default key:

• "default": False: Highest priority (the index is checked first).
• "default": True: Lowest priority.

Safety is always injected with "default": False to ensure it is the first priority in the index list.