# Security in Julia Packages

**URL:** <https://discourse.julialang.org/t/security-in-julia-packages/92883>\
**Category:** Package Management\
**Tags:** question\
**Created:** [January 12, 2023, 4:09pm UTC](https://discourse.julialang.org/t/security-in-julia-packages/92883 "2023-01-12T16:09:14Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jon\_Marcum](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/jon_marcum/32/39213_2.png) [@Jon\_Marcum](https://discourse.julialang.org/u/Jon_Marcum)\
**Post date:** [January 12, 2023, 4:09pm UTC](https://discourse.julialang.org/t/security-in-julia-packages/92883/1 "2023-01-12T16:09:14Z")

</div>

How does Julia insure that packages are not compromised by bad actors? Case in point an article that I read stated that pypi contained 50% of its packages with security vulnerabilities ( [About half of Python libraries in PyPI may have security issues, boffins say • The Register](https://www.theregister.com/2021/07/28/python_pypi_security/#:~:text=Boffins%20in%20Finland%20have%20scanned%20the%20open-source%20software,nearly%20half%20contain%20problematic%20or%20potentially%20exploitable%20code.)). If a user wanted to use Julia on a government required security level server system, what would need to happen to insure that the security level is being met?

---

<div class="post-metadata">

**Author:** ![heliosdrm](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/heliosdrm/32/3851_2.png) [@heliosdrm](https://discourse.julialang.org/u/heliosdrm)\
**Post date:** [January 12, 2023, 5:04pm UTC](https://discourse.julialang.org/t/security-in-julia-packages/92883/2 "2023-01-12T17:04:57Z")

</div>

According to the [README of the General Registry](https://github.com/JuliaRegistries/General) - which is the one used by default for Julia packages:

> The General registry is not a curated list of Julia packages. In particular this means that:
> 
> - packages included in the General registry are **not** reviewed/scrutinized;
> - packages included in the General registry are **not** “official” packages and **not** endorsed/approved by the JuliaLang organization;
> - the General registry and its maintainers are **not** responsible for the package code you install through the General registry – you are responsible for reviewing your code dependencies.

Therefore, no guarantee at all. For what might be worth, though, a big amount of packages are hosted in Github repositories, and they _may_ have enabled security policies (cf. [Code security documentation - GitHub Docs](https://docs.github.com/en/code-security), and the “Security” tab in the repository pages).

---

<div class="post-metadata">

**Author:** ![mbauman](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/mbauman/32/31082_2.png) [@mbauman](https://discourse.julialang.org/u/mbauman)\
**Post date:** [January 12, 2023, 5:18pm UTC](https://discourse.julialang.org/t/security-in-julia-packages/92883/3 "2023-01-12T17:18:36Z")

</div>

> [@Jon\_Marcum](#):
>
> use Julia on a government required security level server system

This is one of the reasons-for-being for JuliaHub — both technically (e.g. support for airgaps, package disallow lists, etc) and administratively (e.g. SOC 2 and other controls).