python/dynamic-code-execution

`eval`/`exec`/`pickle.loads` on external data.

Read it in the terminal

The same facts, from the checkout you are already in — no browser, and no network.

$ npx redlinegate explain python/dynamic-code-execution

Where this came from

You are most likely here from a review comment. A finding names its rule and, when your repository has told Redline where the standard is published, its address:

Redline/BLOCKER [python/dynamic-code-execution]: …
  → …/r/python/dynamic-code-execution

That second line is written by redline init --docs-url and is empty until an organisation sets one — there is no default, because a link to somebody else's copy of the standard is worse than no link. See Onboard a repository.

In context

The Python standard lists this rule with the rest of its stack, in the file a reviewer and an AI assistant both read.

Other BLOCKER rules in this stack

• python/mutable-default-argumentMutable default arguments (`def f(items=[])`) — shared across calls; use `None` + assign inside.
• python/bare-exceptBare `except:` or `except Exception: pass` — catch specific exceptions; never silence. Bare `except` also eats `KeyboardInterrupt`/`SystemExit`.
• python/sql-string-interpolationSQL built with f-strings/`%`/`.format` from external input — parameterized queries only.
• python/subprocess-shell-injection`subprocess` with `shell=True` on anything derived from external input; prefer list-form argv always.
• python/blocking-in-asyncBlocking calls inside `async def`: `requests`, `time.sleep`, sync DB drivers — use `httpx`/`aiohttp`, `asyncio.sleep`, async drivers, or `run_in_executor`.
• python/secrets-not-centralisedSecrets hardcoded or read ad hoc — central config module, validated at startup.