PEP 751: lock files (again)

[ncoghlan (Alyssa Coghlan)]

@brettcannon

I don’t want to enumerate every potential security concern and how to remedy them in the PEP. I’ll have to think about how far I want to take that.

For avoiding auth credentials in URLs, I thought you might be able to reference Version specifiers - Python Packaging User Guide or Direct URL Data Structure - Python Packaging User Guide

However, neither of them actually mention that risk.