ansede-static 2.3.2

AST-based SAST for Python and JavaScript — detects IDOR, auth bypass, and ownership flaws that Bandit misses.

Offline SAST engine.
pip install ansede-static  ·  Zero dependencies  ·  No telemetry

---

Quick Start

pip install ansede-static
ansede-static src/                        # scan a directory
ansede-static src/ --format sarif         # GitHub Code Scanning
ansede-static src/ --fail-on high         # CI gate
ansede-static src/ --incremental          # git-diff mode

Why ansede-static?

Most SAST tools find SQLi, command injection, and XSS. ansede-static finds the bugs they miss — broken access control, missing authentication, and IDOR — by modeling routes, auth guards, and ownership patterns at the AST level.

@app.route("/invoice/<invoice_id>")
@login_required
def get_invoice(invoice_id):
    return db.execute("SELECT * FROM invoices WHERE id = ?", (invoice_id,))
    # → CWE-639 IDOR: any user can see any invoice
    # Bandit/Semgrep OSS: silent.  ansede: CRITICAL

@app.route("/admin/users")
def list_users():
    return User.query.all()
    # → CWE-862: unauthenticated admin access
    # Bandit/Semgrep OSS: silent.  ansede: HIGH

Benchmarks

Metric	Result
CVE recall (115/115 synthetic)	100%
CVE precision	97.5%
Quality benchmark	63/63 checks (100%)
Real repos scanned	35/35 — 12,372 files, 1.76M LOC, 71 MB
CWE types detected	35+
Languages	Python, JS/TS, Go, Java, C#
Zero failures	✅ across all 35 repos
Zero dependencies	✅ pure Python stdlib

Full details in BENCHMARKS.md.

Who is it for?

• Developers who want a pip install-and-scan experience
• CI/CD pipelines that need SARIF output and fail-on gates
• Security teams tired of triaging the same noise from heavier tools

GitHub Action

- uses: mattybellx/Ansede@v2.3.2
  with:
    path: src/
    fail-on: high
    upload-sarif: true

Features

Incremental — --incremental (git diff) or --incremental-sha256 for monorepos
Baseline — freeze legacy debt with --baseline baseline.json
Clustering — 49% finding reduction via incident merging
AI triage — optional local Ollama integration for auto-classification
IDE plugins — VS Code, IntelliJ IDEA, Visual Studio 2022
Outputs — SARIF, JSON, HTML, SBOM, plain text

Contributing

git clone https://github.com/mattybellx/Ansede.git
cd Ansede
pip install -e ".[dev]"
pytest tests/ -q

---

_{MIT licensed · Zero telemetry · No cloud dependency · Built by Matty Bell}