Python supports a mode where the interpreter ignores environment variables such as PYTHONPATH, etc.

However, there are places in the stdlib where environment-sensitive decisions are made, without regard for the ignore-environment flag.

Examples include:
- ssl.get_default_verify_paths() queries SSL_CERT_FILE and SSL_CERT_DIR
- shutil.which() queries PATH
- the tempfile module queries TMPDIR, TEMP, TMP to select the defaut directory for temporary files

Do you think those need to be sanitized?

External libraries like sqlite may also use env vars. I know for sure OpenSSL uses SSL_CERT_FILE and SSL_CERT_DIR to override default verify locations.

I don't think -E is a security feature. Even if the stdlib was fixed, there's tons of 3rdparty Python code that consumes os.environ.

It seems like if you really cared about not letting the environment influence a Python application, you'd just wrap python in a script that cleans out the environment before execing.

I may be mistaken, what's the use of -E if not for security?

It's useful if you want to hide the fact that a command is implemented in Python and don't want it to malfunction if the user has PYTHONPATH set for some reason.