Detects file-loading paths that bypass sys.audit() hooks by using open() instead of io.opencode(), and shell-calling paths where validation occurs before template substitution. Invoke when scanning importlib, webbrowser, or venv.
Detects decompression paths that materialize unbounded output before applying a size check, and allocations whose size is directly controlled by attacker-supplied archive metadata. Invoke when scanning zipfile, tarfile, lzma, bz2, gzip, or plistlib.
Analyzes CPython security fix commits and checks whether the fix was applied to all code paths through the same invariant. The most important agent for preventing second-round CVEs. Invoke after identifying a security fix commit or when reviewing recent type-security labeled changes.
Detects archive extraction paths that may write outside the destination directory. Invoke when scanning tarfile, zipfile, or shutil.unpackarchive for path traversal vulnerabilities.
Detects security-sensitive value types where some assignment paths validate input but others do not. Specializes in the incomplete-fix pattern. Invoke when scanning http.cookies, wsgiref, urllib, or webbrowser for validation gaps.
Archive extraction boundary analysis. Checks whether CPython's tarfile, zipfile, and shutil.unpackarchive implementations correctly enforce the invariant that no extraction path may write outside the declared destination directory.
Audit hook coverage analysis. Checks whether CPython's file-loading and shell-calling paths correctly emit sys.audit() events and whether security controls depending on those events can be bypassed via alternative code paths.
Protocol validation coverage analysis. Checks whether security-sensitive values in CPython's HTTP, cookie, WSGI, and URL handling modules are validated consistently across all code paths — including update methods, operator overloads, unpickling, and template substitution paths.
Full security scan of a CPython source tree using all four engines.
★not rated 1 1mo agoA0 tokens
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: