Skip to main content

Introduction

PySentry is a fast, reliable security vulnerability scanner for Python projects, written in Rust.

Overview​

PySentry audits Python projects for known security vulnerabilities by analyzing dependency files and cross-referencing them against multiple vulnerability databases. It provides comprehensive reporting with support for various output formats and filtering options.

Key Features​

  • Multiple Project Formats: Supports uv.lock, poetry.lock, Pipfile.lock, pylock.toml, pyproject.toml, Pipfile, requirements.txt, and PEP 723 Python scripts
  • External Resolver Integration: Leverages uv and pip-tools for accurate requirements.txt constraint solving
  • Multiple Data Sources (all sources used by default):
    • PyPA Advisory Database
    • PyPI JSON API
    • OSV.dev (Open Source Vulnerabilities)
  • PEP 792 Project Status Markers: Detects archived, deprecated, and quarantined packages
  • Flexible Output for different workflows: Human-readable (compact by default, --detailed for full descriptions), JSON, SARIF, and Markdown formats
  • Security Policy: Per-group fail_on thresholds (be strict in production, lenient in dev) and package-wide ignores — suppressed findings are still reported, never silently dropped
  • Fail-Closed Completeness: If a vulnerability source fails to fetch, the scan is flagged as partial and fails by default (opt out with --no-fail-on-partial), so results are never silently incomplete
  • Performance Focused:
    • Written in Rust for speed
    • Async/concurrent processing
    • Multi-tier intelligent caching (vulnerability data + resolved dependencies)
  • Comprehensive Filtering:
    • Severity levels (low, medium, high, critical, unknown)
    • Dependency scopes (main only vs all dependencies)
    • Specific dependency groups (PEP 735, optional, and Poetry groups) via --group
    • Direct vs. transitive dependencies
  • CI/CD Ready: A first-party GitHub Action with SARIF upload to Code Scanning and a compact job-summary report, plus meaningful exit codes and machine-readable output for any pipeline

Why PySentry?​

PySentry combines the reliability of established tools with the performance benefits of Rust:

  1. Speed: Concurrent processing and intelligent caching make PySentry significantly faster than Python-based alternatives
  2. Accuracy: Uses multiple vulnerability sources for comprehensive coverage
  3. Flexibility: Works with all major Python dependency management tools
  4. CI/CD Ready: Multiple output formats and exit codes designed for automation

Quick Example​

# Scan current directory
pysentry

# Scan specific project
pysentry /path/to/project

# Generate JSON report
pysentry --format json --output report.json

# Only fail on critical vulnerabilities
pysentry --fail-on critical

Getting Help​