Home

CoreTrace Python Analyzer

A standalone static security analyzer for Python. It finds injection vulnerabilities by following attacker-controlled data through the program — across functions, files, objects and closures — and judges each flow against the guards on its path. It also reports dangerous API usage, secrets committed in sources and configuration, and vulnerable or forbidden dependencies, correlated with the code that reaches them.

It runs offline, on a file or a whole project, with no runtime dependency.

pip install coretrace-python-analyzer
coretrace-python-analyzer --check src/ --format sarif > report.sarif

Current release: 0.10.0.

Pages

Page	What it covers
Getting Started	Install, first check, reading the output, exit codes
CLI Reference	Every option, and which ones need a directory check
Rules	Taint flows, dangerous APIs, secrets, dependencies
How a Flow is Judged	Refuted, hotspot or vulnerability — and why
Reports and CI	text/JSON/SARIF, SBOM, VEX, baselines, suppressions, GitHub Actions
Dependencies and Advisories	Advisory files, reachability, policy
Plugins and Models	Extending the analyzer without forking it
Architecture	The pipeline, from source to findings
Performance and Caching	Measured cost, --cache, --jobs

In the repository

The wiki orients; these are kept next to the code and go deeper:

Document	Contents
docs/usage.md	The full usage guide
docs/plugins.md	Writing a plugin
docs/architecture.md	The engine's design and its migration plan
CHANGELOG.md	What changed per release, with the reasoning

What makes it different

• A flow is judged, not just found. A guard that proves the value safe refutes the flow and nothing is reported; a guard that merely looks at it lowers the finding to a hotspot. The verdict and its evidence travel in the finding's metadata.
• Sanitizers inside project functions count. A helper that escapes before answering protects every caller, on every path where it is called.
• Escaping is established, never assumed. Django templates are read to decide whether a rendered response really escapes; where the template cannot be read, the flow is still reported.
• Dependencies are correlated with the code. A vulnerable requirement is one finding; a call reaching the affected API is another; attacker data reaching that call is critical.
• Reports name what produced them. Each plugin and advisory file, with its SHA-256, appears in the JSON, SARIF, SBOM and VEX output.