Vol. 0.5

Ushka

The Python web framework where insecure code, whether you or an AI wrote it, does not run silently. It stops and tells you how to fix it.

Get started Meet Ushka Guard

$ pip install ushka

Or uv add ushka, or the install script (SHA-256: 9d52161aa178…).

Ushka, a cheerful girl with maned-wolf ears and tail in a black hoodie, giving a thumbs up

It stops the bug and hands you the fix

Everything from outside your program arrives as Untrusted: query, form, JSON, headers, cookies, path parameters, and model output. Raw HTML, |safe, redirects, file paths and raw SQL refuse it.

# routes/login.py
async def get(request):
    return redirect(request.query["next"])

UnsafeValueError [USHKA-G003] untrusted value from query:next
reached redirect() (open redirect / phishing).
Fix: redirect(safe.url(value, allow=["/"], default="/"))

A small core with everything in the box

The core needs only uvicorn, Jinja2 and python-multipart. The rest is in the box and stays out of memory until you use it.

Filesystem routingroutes/users/[user_id].py is a route.
t-strings on Python 3.14HTML and SQL that are safe by construction.
Async ORM and migrationsActive Record on SQLAlchemy, with ushka db.
Templates, sessions, flashJinja2 with autoescaping and signed cookies.
Config without extra packagesushka.toml, .env and environment variables.
ushka checkFails your CI on debug mode or a missing secret.

Made for you and your coding agent

Errors carry a stable code and a concrete fix, as JSON when an agent asks for it. ushka new writes an AGENTS.md that teaches the rules, and llms.txt maps these docs for AI tools.

Build your first app