Python Rules Highlights Summary

Every highlight bullet from the 9 pages in this section, gathered on one page and grouped by the page it came from.

How to Use a Python Rules List

• A rules list isn't a law book - it's a codified set of defaults a team agreed not to re-litigate every PR
• Some rules are mechanically enforceable (ruff, mypy); others require human judgment - conflating the two causes both alert fatigue and missed real risks
• This section splits a general master list from domain-specific banks (async, security, data/ML, API design) because each domain has failure modes the others don't
• Numbering rules into groups (1-10 style, 11-20 types...) is a navigation aid, not a priority ranking on its own
• A good rules list documents exceptions as first-class, not as a sign the list has failed

50 Python Rules Every Specialist Should Follow

• Use ruff format with 88-character lines to automate style and avoid debates
• Type hint all public functions and run mypy in CI as a production requirement
• Adopt src layout so packages are installed and tested as consumers see them
• Write one behavior per test with descriptive names and mock at system boundaries
• Raise specific exceptions with clear messages and preserve causes with chaining
• Keep modules under 300 lines with one responsibility and use dependency injection

40 API Design Rules (FastAPI/Django/Flask)

• Use plural nouns for resources and put API versions in the URL path
• Validate all input with Pydantic models for FastAPI or DRF for Django
• Use UUIDs for public IDs and Decimal for money, never float for currency
• Return RFC 7807 errors with specific codes and 422 for validation failures
• Apply explicit CORS allowlists in production and document auth in OpenAPI
• Log structured requests with IDs and propagate correlation headers throughout

30 Async Rules

• One event loop per thread, never call asyncio.run inside a running loop
• Use asyncio.TaskGroup for structured concurrency instead of bare create_task
• Cap concurrency with a semaphore to limit parallel requests and prevent overload
• Never call blocking sleep in async code, use async sleep instead
• Use asyncio.to_thread for blocking I/O when no async library exists
• Stream large responses instead of loading the full body in memory

30 Data/ML Code Rules

• Pin random seeds, data versions, and package versions for reproducible training
• Split and transform data before fitting scalers or encoders to prevent leakage
• Make pipeline steps idempotent so re-running produces identical output
• Use grouped splits for repeated entities and temporal splits for time series
• Validate data schema on ingest and add quality gates in CI before training
• Write model cards for production models documenting intended use and bias

30 Security Rules for Python

• Store secrets in environment variables and secret managers, never in code
• Validate all external input with Pydantic and use parameterized SQL queries only
• Hash passwords with bcrypt or argon2, rotate credentials automatically in production
• Pin dependencies with lockfiles and run weekly audits in CI to reduce attack surface
• Never call eval or exec on user input and avoid unpickling untrusted data
• Run containers as non-root, use HTTPS everywhere, and set security headers like CSP

PEP 8 & Style Reference

• PEP 8 is Python official style guide for modern Python 3.14 projects
• Use 4 spaces indentation and 88 character line length via Black and ruff
• Group imports as stdlib third-party local with blank lines between groups
• Name functions in snake_case and classes in CapWords convention
• Avoid mutable default arguments; use None inside function instead
• Compare to None using identity operators is and is not

Problem / Solution Reference

• Maps common Python tasks to idiomatic production solutions for 3.14
• Use pathlib and rglob for modern file and directory operations
• Handle async I/O with asyncio gather and CPU work with ProcessPoolExecutor
• Validate settings with Pydantic BaseSettings and load dotenv files
• Test with pytest, quality-check with ruff and mypy, profile with cProfile
• Secure passwords with argon2 and tokens with secrets module

Python Architecture Decisions

• Use FastAPI for async APIs with Pydantic validation and OpenAPI generation
• Organize Python projects with src layout and pyproject.toml for reliability
• Use uv for fast dependency installation and reproducible locked environments
• Choose SQLAlchemy 2.0 with asyncpg for mature async database access with type safety
• Manage configuration with pydantic-settings for typed environment variable loading
• Implement background jobs with Celery and Redis for scalable reliable task processing