This is a two-part answer:
- You must overcome any obfuscation or get to some sort of decompiled state. See this question on StackExchangeRE for more details on Python obfuscation.
- Once you have the code (or if you have the source in the first place), you will want to utilize a mixture of secure code review, runtime analysis, and security-focused static analysis to uncover potential findings for triage.
If you are looking for security-focused static analysis tools, sadly many of the commercial ones are just not there yet for the Python language. Pylint and Flake8 also are primarily style or correctness checkers with zero security checks. My top recommendation for Python SAST is the Bandit project from the OpenStack Security team. There are only a few basic checks but you can add more. Bandit is only a slight (but important) improvement over older tools' techniques, such as seen in graudit and RATS.
If you are interested in runtime analysis, most security testers leverage Burp Suite Professional for HTTP/TLS traffic and Canape as a pluggable, local-logging proxy for other protocols. In order to understand file handlers or network protocols that utilize encryption or compression routines during runtime analysis, many security testers turn to software tracing (because it's faster than debugging) or hooking techniques, such as found in the Frida framework. A popular set of flaws targeting serialization (pickling in Python) are becoming more widely known, so it may be worth checking out the OWASP Python Security Project page or list for more information.
For a more-detailed look at Dropbox specifically, see this other answer over at StackExchangeRE, in addition to this Security Analysis of Dropbox code.