In this very short video tutorial, I want to talk to you about an important security measure for Blender users.
Video Transcript
Hello everyone! In this very short video tutorial, I want to talk to you about an important security measure for Blender users. I received an email from an online store recommending that I disable the Auto Run Python Scripts option to avoid the risk of automatically running potentially harmful scripts included in some blend files downloaded from the internet.
If this option is enabled, it allows any Python scripts included in the file to run automatically every time it is opened. In Blender 4.3, you can find it under Edit Preferences, in the Save And Load section, within the Blend Files group. It should be disabled by default, but it's always best to double check. In other versions of Blender, the same option might be located in other sections like System or File Paths, still within Preferences.
My recommendation is to disable this option if it isn’t already, and make the setting permanent by clicking Save Preferences at the bottom left of the Preferences window.
If, after disabling it, you open a Blender file and see a message like "Python scripts not executed" or something similar, it means that there were scripts in the file but they weren't executed. Don’t enable them unless you’re sure about the file’s source and the content of the scripts.
For a more thorough check, you can open the Text Editor inside Blender and see if any scripts are present in the file. In some cases, they might be legitimate scripts, for example for complex rigs or custom tools. However, if you’ve downloaded a simple 3D model, it usually shouldn’t contain scripts. Pay special attention if you see code using modules like os, subprocess, socket, requests, or code that reads/writes files to disk or performs network calls.
The email I received mentioned a script hidden inside an Armature object. Another good practice is to examine the file structure in the Outliner, to check for any suspicious objects with strange or unusually long names, or hidden armatures or other objects.
Some objects may also have drivers or unfamiliar custom properties. In some cases, these might be legitimate elements, but if the file is supposed to contain only a static model, their presence could be a red flag.
I hope this information was useful to you, not to cause alarm, but to help you use Blender more consciously and safely. Unlike most of my video tutorials, the PDF version of this one is not currently available for download. However, in the description you'll find the link to a page with PDF versions of many of my other tutorials. In any case, this is a great time to subscribe to the channel and turn on notifications! See you next time!