Skip to main content

Python

Vulkro does full source analysis for Python. It finds every HTTP endpoint, tracks request data through your code to dangerous sinks, and checks your PyPI dependencies against a local CVE bundle.

Python is in the Free tier. You still need an account and sign-in to scan. See Accounts.

Project detection​

Vulkro spots a Python project from its source files and dependency manifests. It reads exact versions from poetry.lock and Pipfile.lock when they are present.

vulkro scan .
vulkro discover .

Frameworks​

Vulkro extracts endpoints from:

  • FastAPI
  • Flask
  • Django
  • Django REST Framework (DRF)
  • Django Ninja
  • Starlette
  • aiohttp
  • Tornado
  • Litestar

Route prefixes are stitched together so the recorded path matches what the server actually serves. This includes FastAPI include_router(prefix=...), Flask Blueprint(url_prefix=...), and Django urls.py include trees.

It also covers GraphQL (Strawberry, graphene), gRPC, and Starlette WebSockets.

Access model​

Every endpoint is tagged with an AuthTier, its scopes, and its tenant-scoping. This is the same model Vulkro builds for the other languages, and it feeds the OWASP API Top 10 checks (BOLA, broken auth, resource consumption, inventory). See OWASP API Top 10.

Taint analysis​

Vulkro follows request data through function calls to dangerous sinks.

Sources include flask.request.*, Django request.GET / request.POST, FastAPI request.json() / request.form() / request.query_params, and route-handler parameters.

Sinks include:

  • cursor.execute / engine.execute / session.execute without parameter binding
  • subprocess.run(shell=True)
  • eval
  • pickle.loads
  • yaml.load(..., Loader=yaml.Loader)
  • requests.get(...) (SSRF)
  • redirect(...) (open redirect)

Each finding shows the source-to-sink hop chain.

Loop-carried taint is off by default. Turn on the worklist engine with VULKRO_TAINT_CFG=1. See Taint analysis for the full model and its limits.

Dependencies​

Vulkro reads PyPI dependencies from requirements*.txt, Pipfile, and pyproject.toml (resolved via poetry.lock / Pipfile.lock) and matches them against the local CVE bundle.

For a curated set of packages, CVE findings are tagged [reachable] or [unreachable] based on whether the vulnerable code is actually called. See Dependencies and CVEs.

Useful commands​

vulkro scan .
vulkro discover . --format json
vulkro dataflow .
vulkro explain PY-TAINT-SQL-001
Last updated on