BLOCKER
python/subprocess-shell-injection
`subprocess` with `shell=True` on anything derived from external input; prefer list-form argv always.
**/*.pyservice-pythonstandards/stacks/python.md:8Read it in the terminal
The same facts, from the checkout you are already in — no browser, and no network.
$ npx redlinegate explain python/subprocess-shell-injection
Where this came from
You are most likely here from a review comment. A finding names its rule and, when your repository has told Redline where the standard is published, its address:
Redline/BLOCKER [python/subprocess-shell-injection]: … → …/r/python/subprocess-shell-injection
That second line is written by redline init --docs-url and is empty until an organisation sets one — there is no default, because a link to somebody else's copy of the standard is worse than no link. See Onboard a repository.
In context
The Python standard lists this rule with the rest of its stack, in the file a reviewer and an AI assistant both read.
Other BLOCKER rules in this stack
python/mutable-default-argumentMutable default arguments (`def f(items=[])`) — shared across calls; use `None` + assign inside.python/bare-exceptBare `except:` or `except Exception: pass` — catch specific exceptions; never silence. Bare `except` also eats `KeyboardInterrupt`/`SystemExit`.python/sql-string-interpolationSQL built with f-strings/`%`/`.format` from external input — parameterized queries only.python/dynamic-code-execution`eval`/`exec`/`pickle.loads` on external data.python/blocking-in-asyncBlocking calls inside `async def`: `requests`, `time.sleep`, sync DB drivers — use `httpx`/`aiohttp`, `asyncio.sleep`, async drivers, or `run_in_executor`.python/secrets-not-centralisedSecrets hardcoded or read ad hoc — central config module, validated at startup.