frame-security 1.0.0

Sound static analysis and LLM reasoning, in one security agent

Frame finds vulnerabilities by following attacker data through your code, across functions, files and layers, and proves each finding with a solver instead of pattern-matching. An optional LLM layer adds recall, then exploits and fixes what was found.

Why Frame?

• Five languages: Python, JavaScript/TypeScript, Java, C# and C/C++.
• Cross-file by default: a request that enters a controller and reaches a query three files away is one finding.
• 70+ framework packs: Flask to Spring to ASP.NET to Express, plus your own stack in one TOML file.
• Built for guardrails: scan only what changed, baseline what you accept, verify that a fix removed the bug.
• Its own separation logic engine on Z3: entailment, frame inference, bi-abduction and countermodels.
• Runs on open models, local or hosted, for detection, triage, exploitation and fixing.

Quick start

pip install "frame-security[scan]"
frame scan src/

A three-file Flask app, where the request enters in app.py and the query runs in services/orders.py:

# shop/app.py
@app.route("/orders")
def list_orders():
    customer = request.args.get("customer", "")
    return jsonify(orders.for_customer(customer))

# shop/services/orders.py
def for_customer(name):
    cur.execute("SELECT * FROM orders WHERE customer = '" + name.strip() + "'")

$ frame scan benchmarks/exemplars/quickstart --root benchmarks/exemplars/quickstart
1. [CRITICAL] 🔴 sql_injection
   Location: benchmarks/exemplars/quickstart/shop/services/orders.py:8:4
   Description: Tainted data from 'customer' flows to sql sink
   CWE: CWE-89
   Data flow: shop/app.py:11 -> shop/services/orders.py::for_customer(name)
...
Scanned 4 files: 2 findings (2 critical)

Use a placeholder query, or wrap the value in int(), and the finding goes away.

Benchmarks

Methods and every suite, including SL-COMP for the engine, are in benchmarks/README.md.

Documentation

Contributing

pip install -e ".[dev]"
python -m pytest tests/ -n auto
ruff check frame tests benchmarks

CLAUDE.md is the engineering map of the codebase. To add a framework, write a pack under frame/sil/packs/data/<language>/ and a vulnerable/safe app pair under benchmarks/exemplars/frameworks/; the fixture test checks both.

License

Apache 2.0