durescan 2.2.0

A professional AST-based security engine for AI applications that scans your code and finds vulnerabilities, with a full bundled CWE reference dictionary.

durescan

A lightweight Python security scanner: find common security issues in your source code, and look up full details on any CWE (Common Weakness Enumeration) from a bundled offline dictionary.

Installation

pip install durescan

Quick start — scanning code

import durescan

code = """
password = "admin12345"
os.system("rm -rf " + user_input)
cursor.execute("SELECT * FROM users " + user_input)
"""

findings = durescan.scan(code)

for f in findings:
    print(f"[{f['severity']}] line {f['line']}: {f['message']} ({f['cwe']})")

Output:

[ERROR] line 2: A hard-coded password was found in source code... (CWE-798)
[ERROR] line 3: os.system() call detected... (CWE-78)
[ERROR] line 4: A SQL query is being built with string concatenation... (CWE-89)

Each finding is a dict with: id, cwe, message, line, severity.

What it detects

41 built-in rules covering:

• Secrets & credentials — hard-coded passwords, API keys, JWT secrets, cryptographic keys
• Injection — SQL injection (string concat & f-strings), OS command injection, LDAP-style patterns
• Unsafe code execution — eval(), exec(), unsafe pickle.loads(), unsafe yaml.load()
• Weak cryptography — MD5, SHA-1, DES, ECB mode, insecure randomness, weak SSL/TLS protocols
• Web security — Flask/Django debug mode left on, disabled TLS certificate verification, CORS wildcard, open redirects, XXE, SSRF, insecure cookies (missing Secure/HttpOnly)
• Misc hardening — insecure temp files, world-writable file permissions, sensitive data in logs/print statements, ReDoS-prone regex patterns

Every rule is our own — written and tested from scratch, not pulled from any third-party rules registry.

CWE reference lookup

durescan also bundles a full offline CWE dictionary (969 entries, MITRE's official CWE List v4.20, dated April 30, 2026) so you can enrich findings or look things up without needing internet access:

import durescan

info = durescan.get_cwe("CWE-89")
print(info["name"])                 # SQL Injection (full official name)
print(info["description"])
print(info["likelihood_of_exploit"])
for m in info["potential_mitigations"]:
    print(f"[{m['phase']}] {m['description']}")

# All CWE IDs available offline
all_ids = durescan.list_cwes()
print(len(all_ids), "CWEs bundled")   # 969

print(durescan.cwe_count())           # 969

get_cwe() accepts either "CWE-89" or plain "89".

Each entry includes:

• name, abstraction, status
• description, extended_description
• likelihood_of_exploit
• common_consequences — list of {scope, impact}
• potential_mitigations — list of {phase, description}
• related_weaknesses — list of {cwe_id, nature} (parent/child relationships)

A note on how scanning works

durescan.scan() uses a regex-based pattern engine (not a full AST/dataflow analyzer), so it's fast and dependency-light, but it matches on code shape rather than true program semantics. It's best used as a quick first-pass scanner or a pre-commit check — for deep, cross-file taint analysis, pair it with a heavier tool.

License & data sources

• All 41 detection rules are original work.
• The bundled CWE dictionary is parsed directly from MITRE's official CWE List v4.20 XML release (dated April 30, 2026). CWE content itself is freely usable per MITRE's CWE Terms of Use; the parsing code here is original.

Changelog

2.2.0

• Added 4 new original rules to restore coverage that was lost when the Semgrep-sourced content was removed in 2.0.0: Flask routes returning a raw f-string (potential XSS, CWE-79), insecure plain-HTTP requests via requests.get()/requests.post() (CWE-319), and credentials interpolated into logger calls via f-strings (CWE-532). Total rule count: 41 → 45.

2.1.1

• Bugfix: eval-usage and exec-usage rules were false-flagging unrelated method calls that merely end in .eval( or .exec( — most notably model.eval() (PyTorch's standard call to switch a model to evaluation mode), which has nothing to do with Python's eval() builtin. Both rules now require the call to be standalone (not preceded by a .), so model.eval(), tokenizer.eval(), etc. are correctly ignored while eval(user_input) is still caught.

2.1.0

• Refreshed the bundled CWE dictionary from MITRE's official CWE List v4.20 (April 30, 2026) — parsed directly from MITRE's own XML release, replacing the earlier third-party-repackaged v4.15 (July 2024) dataset. Now 969 entries (was 964).

2.0.0

• Rules file rewritten from scratch (41 original rules, no third-party rule content)
• Added full offline CWE dictionary (969 entries, MITRE CWE v4.20) and lookup API: get_cwe(), list_cwes(), cwe_count()