Install & Compatibility
Where this runs
tested against v2.0.1 · pip install
no network on importno background threads
Install × environment matrix
Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux
muslpy 3.10–3.95 runs
installs and imports cleanly · install 0.0s · import 0.080s · 18.3MB
glibcpy 3.10–3.95 runs
installs and imports cleanly · install 1.5s · import 0.074s · 19MB
16MB installed
● package 16MB
Code
Verified usage
Verified import paths — ran on the pinned version, not inferred.
Secure
✓ from secure import Secure
Main class for applying security headers.
ContentSecurityPolicy
✓ from secure import ContentSecurityPolicy
For building custom CSP policies.
PermissionsPolicy
✓ from secure import PermissionsPolicy
For building custom Permissions Policy headers.
SecureWSGIMiddleware
✓ from secure.middleware import SecureWSGIMiddleware
✗ from secure import SecureWSGIMiddleware
Available from v1.x.x, official middleware path for WSGI frameworks (e.g., Flask, Django) in v2.0.0rc1.
SecureASGIMiddleware
✓ from secure.middleware import SecureASGIMiddleware
✗ from secure import SecureASGIMiddleware
Available from v1.x.x, official middleware path for ASGI frameworks (e.g., FastAPI, Starlette) in v2.0.0rc1.
SecureHeaders
✓ from secure import Secure
✗ from secure import SecureHeaders
The `SecureHeaders` class was part of the 0.x.x API and was removed in v1.0.0. Use `secure.Secure` instead.
SecureCookie
✓ N/A (Functionality removed)
✗ from secure import SecureCookie
Cookie management functionality (`SecureCookie` class) was removed entirely in v0.3.0/v1.0.0. This is no longer supported.
This Flask example demonstrates how to integrate `secure.py` by applying default security headers to every response using an `after_request` hook. The `Secure.with_default_headers()` method provides a baseline set of recommended headers.
import os
from flask import Flask, Response
from secure import Secure
app = Flask(__name__)
# Instantiate Secure with default headers (or customize)
# For v2.0.0rc1 and later, consider `Secure.with_preset(Preset.BALANCED)` or middleware.
secure_headers = Secure.with_default_headers()
@app.after_request
def add_security_headers(response: Response):
secure_headers.set_headers(response)
return response
@app.route("/")
def home():
return "Hello, secure world!"
if __name__ == "__main__":
# In a real application, use a production-ready WSGI server like Gunicorn
app.run(debug=True)
Debug
Known issues
breakingVersion 2.0.0 (currently in Release Candidate) introduces a significant API overhaul, including a new preset model (e.g., `Preset.BALANCED`), first-class ASGI/WSGI middleware, and changes to the behavior of `with_default_headers()`. Review the migration guide when upgrading to 2.x.x.fixConsult the official migration guide (e.g., `docs/migration.md` on GitHub) to adapt to the new API and preset models. Consider using `SecureASGIMiddleware` or `SecureWSGIMiddleware` for framework-agnostic integration.
affects: >=2.0.0rc1
breakingThe library underwent a complete API redesign in v1.0.0 from its 0.x.x versions. Old classes like `SecureHeaders` and `SecureCookie` were removed or replaced. Additionally, v1.0.0 requires Python 3.10+.fixRewrite code using the new `secure.Secure` class and its methods. Ensure your project is running on Python 3.10 or newer. Cookie management functionality has been removed; you'll need a different library or custom implementation for secure cookies.
affects: 0.x.x to 1.x.x
breakingThe `SecureCookie` class and all cookie management features were removed starting from version 0.3.0 and are not present in 1.x.x or 2.x.x. The library now exclusively focuses on HTTP security headers.fixRemove any reliance on `secure.SecureCookie`. Implement secure cookie handling using your web framework's native capabilities or a dedicated cookie security library.
affects: >=0.3.0
gotchaThe `Feature-Policy` HTTP header was renamed to `Permissions-Policy` as part of a specification update. `secure.py` adopted this change in v0.3.0/v1.0.0, so older configurations might be using the deprecated name.fixUpdate any custom header configurations or policy builders to use `PermissionsPolicy` instead of `FeaturePolicy`.
affects: 0.x.x (pre-0.3.0)
Upgrade
Version history
2.0.1latest on PyPI · released Apr 22, 2026
Audit
Dependencies
pythonrequiredRequires Python 3.10 or higher for modern language features.