Metadata-Version: 2.5
Name: coretrace-python-analyzer
Version: 0.1.0
Summary: Static security analysis infrastructure for Python code
Project-URL: Homepage, https://github.com/CoreTrace/coretrace-python-analyzer
Project-URL: Repository, https://github.com/CoreTrace/coretrace-python-analyzer
Project-URL: Issues, https://github.com/CoreTrace/coretrace-python-analyzer/issues
Author: CoreTrace
License: Apache-2.0
Keywords: python,sast,security,static-analysis,taint
Classifier: Development Status :: 4 - Beta
Classifier: Environment :: Console
Classifier: Intended Audience :: Developers
Classifier: License :: OSI Approved :: Apache Software License
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Topic :: Security
Classifier: Topic :: Software Development :: Quality Assurance
Requires-Python: >=3.11
Provides-Extra: dev
Requires-Dist: build>=1.2; extra == 'dev'
Requires-Dist: mypy>=1.15; extra == 'dev'
Requires-Dist: pytest>=8.0; extra == 'dev'
Requires-Dist: ruff>=0.9; extra == 'dev'
Requires-Dist: twine>=5.0; extra == 'dev'
Description-Content-Type: text/markdown

# CoreTrace Python Analyzer

A standalone static security analyzer for Python. It finds injection vulnerabilities by
following attacker-controlled data through the program, across functions, files, objects
and closures, and judges each flow against the guards on its path; it reports dangerous
API usage, secrets committed in sources and configuration, and vulnerable or forbidden
dependencies, correlated with the code that reaches them. It runs offline, on a file or a
whole project, with no runtime dependency.

```bash
pip install coretrace-python-analyzer
coretrace-python-analyzer --check src/ --format sarif > report.sarif
```

- [Usage guide](docs/usage.md): command line, rules, report formats, dependencies and
  advisories, cache and parallelism, continuous integration.
- [Writing a plugin](docs/plugins.md): models for another framework, detectors for
  another rule, secret patterns and project-wide checks.
- [Architecture](docs/architecture.md): the engine's design and its migration plan.

The pipeline: source manager, parser-independent high-level representation (PyHIR),
semantic resolution of imports and scopes, lowering to a small intermediate
representation (PyIR), control-flow graphs, SSA, data-flow and abstract interpretation,
interprocedural summaries, taint and refutation, then plugins and reporters.

## Development

```bash
python -m venv .venv
python -m pip install -e ".[dev]"
python -m mypy
python -m pytest
python -m ruff check .
```

The non-regression suite analyses the public repositories pinned in
[`tests/regression/repositories.toml`](tests/regression/repositories.toml) and compares
findings and coverage with the snapshots in `tests/regression/expected/`. It clones on
first use, needs the network and runs in its own CI job:

```bash
python -m pytest -m regression
CORETRACE_REGRESSION_UPDATE=1 python -m pytest -m regression   # record an intended change
```

