Powerful tools should be easy to use.

Redesigning the Python Package Index

Python Software Foundation

• User research
• UI design
• Visual identity
• Front-end implementation
• Accessibility
• Internationalisation

PyPI is the official software repository for the Python programming language, visited by 3.4 million people a month from more than 200 countries.

We've worked with the PyPI team for over a decade, through a full platform rebuild and ongoing security and usability improvements. Our work includes:

• User research and testing
• Interface redesign, logo, and visual identity
• HTML/CSS (SCSS) development leadership
• Internationalisation and accessibility
• Community pull request review and contributor support

Working with Nicole [from Kabu Creative] is a delight.

I've had the opportunity to collaborate with Nicole as a core developer on the Python Package Index.

Nicole's thoughtful and dedicated approach to design shows clearly in the outcomes of user research, individual changes, and broader user experience.

As a core developer on the PyPI project, Nicole is patient and helpful while remaining decisive and friendly amidst contentious decisions.

Researching how developers use pip

Python Packaging Authority / Python Software Foundation

• User research
• Documentation

pip is the default command-line tool developers use to install Python packages. In 2020, as pip prepared to launch a new dependency resolver, a donor-funded research programme set out to understand who uses pip, how they use it, and where it lets them down.

Working with Simply Secure, we interviewed users, ran surveys, and built a long-term research panel. The findings shaped how the dependency resolver handles conflicts, as well as pip's error messages and documentation.

• User interviews and surveys on pip usage
• Personas, mental models, and research into how users think about security
• Recommendations on resolver behaviour, error messages, and docs

Helping package consumers understand attestations

Open Source Security Foundation

• User research
• UI design
• Front-end implementation
• Documentation
• Community communications

Package registries such as PyPI, RubyGems, and npm now support attestations: verifiable records of package provenance (where, how, and by whom a package was built). But there was little guidance on how to present attestations to package consumers so that they could understand how to use that information.

OpenSSF funded a two-phase project to close this gap, with Kabu involved in both phases:

Phase 1: cross-ecosystem research. Led by Superbloom, in collaboration with Kabu and the OpenSSF Securing Software Repositories Working Group.

We interviewed and observed open source maintainers, security researchers, and package consumers to learn how they judge whether a package can be trusted. The findings became the OpenSSF Attestation UX/UI Style Guide.

Phase 2: PyPI implementation. Led by Kabu, working with the PyPI team. We researched how to adapt the style guide to PyPI, then designed and built the production interface.

• Further user research on how to handle multiple attestations, releases containing many files, and warning states
• Redesigned and rebuilt PyPI's project pages
• Updated documentation, including PyPI's package security and provenance guides
• Blog posts explaining the changes to users