50 Python Rules Every Specialist Should Follow

A master checklist of habits that separate production Python from tutorial code. Grouped by domain; every rule is actionable and enforceable with tooling where noted.

Recipe

Scan this list quarterly. Enable ruff/mypy rules that automate each "enforceable" item.

When to reach for this:

• Onboarding senior Python developers
• Architecture reviews and code audit baselines
• Configuring team lint and CI policy

Python Rules Reference

Deep Dive

Style & Readability (1-10)

1. Follow PEP 8 - 88-char lines with ruff format; no manual style debates.
2. Use descriptive names - invoice_total, not x or tmp.
3. Prefer f-strings - f"{name}" over "{}".format() and % formatting.
4. Import order: stdlib, third-party, first-party - let ruff isort enforce.
5. One statement per line - no semicolon chains or compound if foo: bar().
6. Explicit is better than implicit - no magic numbers; use named constants.
7. Flat is better than nested - early returns over 5-level indentation.
8. Use pathlib.Path - not os.path.join for new code.
9. Use enum.Enum - for fixed sets of constants, not string literals.
10. Docstrings on public APIs - Google or NumPy style; one-line minimum.

Types & Contracts (11-20)

11. Type hint all public functions - parameters and return types.
12. Run mypy or pyright in CI - types are contracts, not suggestions.
13. Use X | None, not Optional[X] - Python 3.14 union syntax.
14. Prefer list[str] over List[str] - builtin generics (PEP 585).
15. Use TypedDict or Pydantic - for structured dicts, not bare dict.
16. Narrow types with isinstance - not bare type() checks.
17. Use Protocol for duck typing - structural subtyping over ABCs when appropriate.
18. Mark intentional any with comments - # type: ignore needs a reason.
19. Dataclasses for data containers - frozen=True when immutable.
20. Pydantic 2 for validation boundaries - HTTP input, config, external data.

Structure & Modules (21-30)

21. src/ layout - package installable and testable as consumers see it.
22. One responsibility per module - files under 300 lines; split when larger.
23. No circular imports - restructure or use TYPE_CHECKING lazy imports.
24. Absolute imports - from myapp.services import billing, not relative dot chains in libraries.
25. Explicit __all__ - for package public API surface.
26. No logic in __init__.py - re-exports only; keep it thin.
27. Dependency injection over globals - pass dependencies as parameters or fixtures.
28. Config via environment + pydantic-settings - not hardcoded secrets or paths.
29. Separate domain from I/O - pure functions testable without mocks.
30. Use pyproject.toml - single config for deps, tools, and build.

Errors & Testing (31-40)

31. Specific exceptions - raise ValueError("pct must be 0-100"), not bare raise Exception.
32. Never swallow exceptions - except: pass is almost always wrong.
33. Use exception chaining - raise NewError(...) from original.
34. Context managers for resources - with open(...) and @contextmanager.
35. pytest for all tests - no unittest boilerplate for new code.
36. One behavior per test - descriptive names: test_discount_over_100_raises.
37. Mock at boundaries - HTTP, DB, filesystem; not internal logic.
38. 80% coverage floor - branch coverage on critical modules.
39. No print in libraries - use logging with module-level logger.
40. Structured logging in production - JSON logs with correlation IDs.

Security & Operations (41-50)

41. Never commit secrets - env vars, secret managers, .env gitignored.
42. Pin dependencies - lockfile committed; uv sync --frozen in CI.
43. Validate all external input - Pydantic at API boundaries.
44. Use secrets module - not random for tokens and passwords.
45. Parameterized SQL - never f-string SQL queries.
46. Keep Python updated - security patches within 30 days of release.
47. Run pip-audit in CI - weekly dependency vulnerability scan.
48. Least privilege - minimal IAM, DB permissions, and file access.
49. Graceful shutdown - handle SIGTERM; flush logs and close connections.
50. Measure before optimizing - profile first; readability default over speed.

Gotchas

• Treating rules as dogma - context matters; document exceptions in ADRs. Fix: rules guide defaults, not absolutes.
• Enabling all ruff rules day one - alert fatigue. Fix: adopt incrementally per group above.
• Types without tests - mypy green but behavior wrong. Fix: pair types with pytest coverage.
• 50 rules, zero automation - rules decay without CI. Fix: map rules to ruff/mypy/pre-commit gates.
• Applying library rules to scripts - one-off scripts can relax structure rules. Fix: scope rules by package type.

Alternatives

FAQs

Related

• PEP 8 & Style Reference - style details
• 30 Security Rules for Python - security deep dive
• Python Architecture Decisions - structural choices
• Linting & Formatting Best Practices - tooling enforcement

Stack versions: This page was written for Python 3.14.0, FastAPI 0.115+, Django 5.2, Flask 3.1, Pydantic 2, PyTorch 2.6+, pandas 2.2+, Polars 1.x, ruff 0.9+, and uv 0.6+.