CoreTrace Python Analyzer
A standalone static security analyzer for Python. It finds injection vulnerabilities by following attacker-controlled data through the program, across functions, files, objects and closures, and judges each flow against the guards on its path; it reports dangerous API usage, secrets committed in sources and configuration, and vulnerable or forbidden dependencies, correlated with the code that reaches them. It runs offline, on a file or a whole project, with no runtime dependency.
pip install coretrace-python-analyzer
coretrace-python-analyzer --check src/ --format sarif > report.sarif
- Usage guide: command line, rules, report formats, dependencies and advisories, cache and parallelism, continuous integration.
- Writing a plugin: models for another framework, detectors for another rule, secret patterns and project-wide checks.
- Architecture: the engine's design and its migration plan.
The pipeline: source manager, parser-independent high-level representation (PyHIR), semantic resolution of imports and scopes, lowering to a small intermediate representation (PyIR), control-flow graphs, SSA, data-flow and abstract interpretation, interprocedural summaries, taint and refutation, then plugins and reporters.
Repository documents
Development
python -m venv .venv
python -m pip install -e ".[dev]"
python -m mypy
python -m pytest
python -m ruff check .
The non-regression suite analyses the public repositories pinned in
tests/regression/repositories.toml and compares
findings and coverage with the snapshots in tests/regression/expected/. It clones on
first use, needs the network and runs in its own CI job:
python -m pytest -m regression
CORETRACE_REGRESSION_UPDATE=1 python -m pytest -m regression # record an intended change
License
1 maintainer
Metadata
1 maintainer
Release files for coretrace-python-analyzer 0.22.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | |
|---|---|---|---|---|
| coretrace_python_analyzer-0.22.0.tar.gz | 535.9 kB | With provenance | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| coretrace_python_analyzer-0.22.0-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 820.6 kB
Release files / coretrace_python_analyzer-0.22.0.tar.gz
| Download URL | coretrace_python_analyzer-0.22.0.tar.gz |
|---|---|
| Size | 535.9 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
21013c78a9244572b0ccf299e78b39b34f5ad8254c483a5b740ea04f8071d348
|
|
BLAKE2b-256 checksum How to use checksums |
f275fe5b2cc90fa79141b2dd0f6ea84f93780b4c85d40c2cd1a75c0ab410ebc7
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 8, 2026.
Transparency logRelease files / coretrace_python_analyzer-0.22.0-py3-none-any.whl
| Download URL | coretrace_python_analyzer-0.22.0-py3-none-any.whl |
|---|---|
| Size | 284.7 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
12093099c21a687028815552c411627bfa5e4b9a3cd9d8bb8cc1d63555a5ab89
|
|
BLAKE2b-256 checksum How to use checksums |
8e30106a4725356a654dde20dfb7f229fd0a5e6183b8479c7dcd29acd5ddbc32
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 8, 2026.
Transparency logSecurity for coretrace-python-analyzer 0.22.0
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
Full provenance
All 2 files in this release have been uploaded with provenance metadata.
Attestation for coretrace_python_analyzer-0.22.0.tar.gz
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 8, 2026.
Transparency logA note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
