CoreTrace Python Analyzer
A standalone static security analyzer for Python. It finds injection vulnerabilities by following attacker-controlled data through the program, across functions, files, objects and closures, and judges each flow against the guards on its path; it reports dangerous API usage, secrets committed in sources and configuration, and vulnerable or forbidden dependencies, correlated with the code that reaches them. It runs offline, on a file or a whole project, with no runtime dependency.
pip install coretrace-python-analyzer
coretrace-python-analyzer --check src/ --format sarif > report.sarif
- Usage guide: command line, rules, report formats, dependencies and advisories, cache and parallelism, continuous integration.
- Writing a plugin: models for another framework, detectors for another rule, secret patterns and project-wide checks.
- Architecture: the engine's design and its migration plan.
The pipeline: source manager, parser-independent high-level representation (PyHIR), semantic resolution of imports and scopes, lowering to a small intermediate representation (PyIR), control-flow graphs, SSA, data-flow and abstract interpretation, interprocedural summaries, taint and refutation, then plugins and reporters.
Development
python -m venv .venv
python -m pip install -e ".[dev]"
python -m mypy
python -m pytest
python -m ruff check .
The non-regression suite analyses the public repositories pinned in
tests/regression/repositories.toml and compares
findings and coverage with the snapshots in tests/regression/expected/. It clones on
first use, needs the network and runs in its own CI job:
python -m pytest -m regression
CORETRACE_REGRESSION_UPDATE=1 python -m pytest -m regression # record an intended change
1 maintainer
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
Built Distribution
Filter files by name, interpreter, ABI, and platform.
If you're not sure about the file name format, learn more about wheel file names.
Copy a direct link to the current filters
File details
Details for the file coretrace_python_analyzer-0.1.0.tar.gz.
File metadata
- Download URL: coretrace_python_analyzer-0.1.0.tar.gz
- Upload date:
- Size: 242.4 kB
- Tags: Source
- Uploaded using Trusted Publishing? Yes
- Uploaded via:
twine/7.0.0 CPython/3.13.14
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 |
e47cbee3e3072dd4de37895beb5084bbccdc1d4cd56b0a716b4dadce0fc4aade
|
|
| MD5 |
08b6c3fdaf5479f7be879bc468c85c90
|
|
| BLAKE2b-256 |
f020d748ba36ebd7d09e701acb492f6a71dcdcf95f8c392df564ed6915fce51e
|
Provenance
The following attestation bundles were made for coretrace_python_analyzer-0.1.0.tar.gz:
Publisher:
release.yml on CoreTrace/coretrace-python-analyzer
-
Statement:
-
Statement type:
https://in-toto.io/Statement/v1 -
Predicate type:
https://docs.pypi.org/attestations/publish/v1 -
Subject name:
coretrace_python_analyzer-0.1.0.tar.gz -
Subject digest:
e47cbee3e3072dd4de37895beb5084bbccdc1d4cd56b0a716b4dadce0fc4aade - Sigstore transparency entry: 2714124560
- Sigstore integration time:
-
Permalink:
CoreTrace/coretrace-python-analyzer@72ff7c7f71884d7f421a84e6adce716406362bc3 -
Branch / Tag:
refs/tags/v0.1.0 - Owner: https://github.com/CoreTrace
-
Access:
public
-
Token Issuer:
https://token.actions.githubusercontent.com -
Runner Environment:
github-hosted -
Publication workflow:
release.yml@72ff7c7f71884d7f421a84e6adce716406362bc3 -
Trigger Event:
push
-
Statement type:
File details
Details for the file coretrace_python_analyzer-0.1.0-py3-none-any.whl.
File metadata
- Download URL: coretrace_python_analyzer-0.1.0-py3-none-any.whl
- Upload date:
- Size: 167.6 kB
- Tags: Python 3
- Uploaded using Trusted Publishing? Yes
- Uploaded via:
twine/7.0.0 CPython/3.13.14
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 |
0f81f876b55296318b8808bdfa76e8b4d201e0cc1d4d4a35574adc3c2d8b9eb8
|
|
| MD5 |
d52053a6ee656fd53cbb053592f6bcab
|
|
| BLAKE2b-256 |
89c9d2bb312afe19195c2d215531b0b40edb03b72bbe0c89f105ec2ed03b4c71
|
Provenance
The following attestation bundles were made for coretrace_python_analyzer-0.1.0-py3-none-any.whl:
Publisher:
release.yml on CoreTrace/coretrace-python-analyzer
-
Statement:
-
Statement type:
https://in-toto.io/Statement/v1 -
Predicate type:
https://docs.pypi.org/attestations/publish/v1 -
Subject name:
coretrace_python_analyzer-0.1.0-py3-none-any.whl -
Subject digest:
0f81f876b55296318b8808bdfa76e8b4d201e0cc1d4d4a35574adc3c2d8b9eb8 - Sigstore transparency entry: 2714124587
- Sigstore integration time:
-
Permalink:
CoreTrace/coretrace-python-analyzer@72ff7c7f71884d7f421a84e6adce716406362bc3 -
Branch / Tag:
refs/tags/v0.1.0 - Owner: https://github.com/CoreTrace
-
Access:
public
-
Token Issuer:
https://token.actions.githubusercontent.com -
Runner Environment:
github-hosted -
Publication workflow:
release.yml@72ff7c7f71884d7f421a84e6adce716406362bc3 -
Trigger Event:
push
-
Statement type:
