I'd have to agree with pekk's reply in general about trusting what you've written to the filesystem. That being said, it's easy to securely unpickle builtin or

I'd have to agree with pekk's reply in general about trusting what you've written to the filesystem. That being said, it's easy to securely unpickle builtin or whitelisted types: 1. Use a cPickle.Unpickler instance, and set its "find_global" attribute to None to disable importing any modules (thus restricting loading to builtin types such as dict, int, list, string, etc). 2. Use a cPickle.Unpickler instance, and set its "find_global" attribute to a function that only allows importing of modules and names from a whitelist. 3. Use something like the itsdangerous package to authenticate the data before unpickling it if you're loading it from an untrusted source. Anyway, this whole issue is largely tangential from what the OP was discussing.