septr — runtime security middleware for Python

Protects FastAPI and Flask apps at runtime: secrets leaking in responses, BOLA/IDOR, missing auth, business-logic tampering, PII, prompt injection, SSRF, and missing rate limits. Auto-verified against the Septr backend, with per-engine SOC 2 evidence for your dashboard.

Install

pip install septr

Add your key to .env:

SEPTR_API_KEY=septr_live_...

FastAPI

from fastapi import FastAPI
from septr.adapters.fastapi import SeptrASGIMiddleware
import os

app = FastAPI()

app.add_middleware(
    SeptrASGIMiddleware,
    api_key=os.getenv("SEPTR_API_KEY"),
)

Flask

from flask import Flask
from septr.adapters.flask import SeptrFlask
import os

app = Flask(__name__)
# ... your routes ...
app.wsgi_app = SeptrFlask(app.wsgi_app, {"apiKey": os.getenv("SEPTR_API_KEY")})

Config

Option	Type	Default	Description
`apiKey`	str	env `SEPTR_API_KEY`	Backend API key
`strictMode`	bool	`False`	Block instead of detect
`secrets`	bool	`True`	Secret/PII detection + response scrubbing
`bola`	bool	`True`	BOLA/IDOR detection
`rateLimit`	bool	`True`	Per-route rate limiting
`inputSanitize`	bool	`True`	SQLi/XSS/NoSQLi sanitization
`ssrf`	bool	`True`	SSRF heuristics
`promptInjection`	bool	`True`	Prompt-injection shielding
`aiRateLimit`	bool	`True`	Rate limiting for AI endpoints
`tamper`	bool	`True`	Business-logic tamper detection
`missingAuth`	bool	`True`	Missing-auth detection
`stripFields`	list[str]	`[]`	Fields to strip from responses
`telemetry_url`	str	`https://api.septr.com/v1/events`	Telemetry endpoint

Environment variables

SEPTR_API_KEY — your project key
SEPTR_SILENCE_ENV_WARNING — set to 1 to silence the fail-loud missing-key warning

License

MIT

Development Status
- 4 - Beta
Intended Audience
- Developers
License
- OSI Approved :: MIT License
Programming Language
- Python :: 3
Topic
- Security

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

septr-0.1.17.tar.gz (48.5 kB view details)

Uploaded Sep 3, 2026 Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

The dropdown lists show the available interpreters, ABIs, and platforms. Enable javascript to be able to filter the list of wheel files.

septr-0.1.17-py3-none-any.whl (42.6 kB view details)

Uploaded Sep 3, 2026 Python 3

File details

Details for the file septr-0.1.17.tar.gz.

File metadata

Download URL: septr-0.1.17.tar.gz
Upload date: Sep 3, 2026
Size: 48.5 kB
Tags: Source
Uploaded using Trusted Publishing? Yes
Uploaded via: twine/7.0.0 CPython/3.13.14

File hashes

Hashes for septr-0.1.17.tar.gz
Algorithm	Hash digest
SHA256	`ee7c6363f0dea133b0b2fd86a91356cb286023151f510c02e1b736b0a5c85983`
MD5	`c2b5f4b453e5aac376888b0923296528`
BLAKE2b-256	`3805ac63d894d306d8ff426abe225220eb238719af325491cfd84f5fd58160db`

See more details on using hashes here.

Provenance

The following attestation bundles were made for septr-0.1.17.tar.gz:

Publisher: publish.yml on LintGRC/septr

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Statement:
- Statement type: https://in-toto.io/Statement/v1
- Predicate type: https://docs.pypi.org/attestations/publish/v1
- Subject name: septr-0.1.17.tar.gz
- Subject digest: ee7c6363f0dea133b0b2fd86a91356cb286023151f510c02e1b736b0a5c85983
- Sigstore transparency entry: 2701493929
- Sigstore integration time: Sep 3, 2026
Source repository:
- Permalink: LintGRC/septr@6ea60513bbc607a611bd6f7ba3b9996765bf3a35
- Branch / Tag: refs/tags/v0.1.17
- Owner: https://github.com/LintGRC
- Access: public
Publication detail:
- Token Issuer: https://token.actions.githubusercontent.com
- Runner Environment: github-hosted
- Publication workflow: publish.yml@6ea60513bbc607a611bd6f7ba3b9996765bf3a35
- Trigger Event: push