How can I ensure that my Python web application source code is secure?

Question

Note: I'm new to information security practices so feel free to point out anything I could be doing better.

Situation: I'm creating a web application that runs a Python program as part of the back end. This file is closed source and must be secured from anyone trying to accesses it without permission.

What is the best way to go about securing this file from being copied or seen while still allowing the web application to send input data to the file and receive the proper outputs from the same file?

Also, I'd like to point out that the service doesn't need "bank-level" security, obviously the more secure the better but currently we only have the resources to allow for security measures that are relatively easy to implement.

My original thought was to install Python on the web server and simply use the interpreter to execute the .py file. I'm assuming this is probably pretty insecure, due to the fact that the actual file is just sitting on the web server for anyone to look at?

Secondly, I thought of using a program (Nuitka or PyInstaller) to convert the Python into an executable then just having the binary on the web server. I'm not entirely sure how much this would increase the difficulty to get the source code but more importantly, my colleagues are concerned that using a third party software to convert confidential code is a security risk in itself. Meaning, the software could potentially make copies of the program and ultimately leak the program in some way that could do harm.

Are either of the above methods sufficient or is there a better way of approaching the security of the source code?

Answer 1

Either of those methods should be sufficient, assuming your webserver is set up properly and does not allow users to drop into and view the file system structure.

If you want to compile the code into an executable, and ensure the developers of the compiling software can't get the code sent back to them, set up a development system as a virtual with all of the software you need, but none of your code. Shut down the virtual, make a copy/clone with a full copy of the virtual hard drive. Fire up the copy, remove the network adaptor, and connect it to a separate virtual drive (this drive should be in a separate folder and you'll place your code onto it the first time you use it). Do all of your work on the clone, copy the executable to removable storage (USB, CDROM, etc), then place the finished work on the webserver. At least once a month shut down and delete the clone system (taking care to preserve the separate virtual drive with your code), fire up the original virtual, complete any OS and application updates, and create a new clone (doing the same steps of removing the network adaptor and connecting the virtual drive with your code).