aegis-python-security-scanner 1.0.0__tar.gz

aegis_python_security_scanner-1.0.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Aegis Code
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES, YETCH, OR
+OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, INJURES, OR OTHERWISE,
+ARISING FROM, OUT OF OR THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

aegis_python_security_scanner-1.0.0/PKG-INFO

@@ -0,0 +1,81 @@
+Metadata-Version: 2.4
+Name: aegis-python-security-scanner
+Version: 1.0.0
+Summary: A lightweight, local-first Python SAST security scanner
+Home-page: https://github.com/am9024048-hue/Aegis-code
+Author: Ahmed Mohamed
+License: MIT
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Topic :: Security
+Requires-Python: >=3.8
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: rich>=13.0.0
+Dynamic: author
+Dynamic: classifier
+Dynamic: description
+Dynamic: description-content-type
+Dynamic: home-page
+Dynamic: license
+Dynamic: license-file
+Dynamic: requires-dist
+Dynamic: requires-python
+Dynamic: summary
+
+# Aegis Code
+
+A lightweight, local-first Python static application security testing (SAST)
+scanner. Aegis analyzes Python source with the built-in AST module and checks
+text for likely hardcoded secrets.
+
+## Features
+
+- Detects likely hardcoded API keys and tokens.
+- Flags calls to `eval()` and `exec()`.
+- Warns about imports of `pickle`, `telnetlib`, and `xmlrpclib`.
+- Scans source text in memory or reads a Python file from disk.
+- Returns findings as Python objects that can be converted to dictionaries.
+
+## Install
+
+From this directory:
+
+```bash
+python -m pip install -e .
+```
+
+This installs the `aegis` package and the `aegis` command.
+The PyPI distribution name is `aegis-python-security-scanner`; the Python
+import name is `aegis`.
+
+## Scan a file
+
+```bash
+aegis path/to/file.py
+```
+
+## Use the Python API
+
+```python
+from aegis import AegisEngine
+
+engine = AegisEngine()
+findings = engine.scan_code("result = eval(user_input)", file_path="example.py")
+
+for finding in findings:
+    print(finding.to_dict())
+```
+
+`scan_file()` scans a path on disk. `scan_code()` scans a string in memory.
+Findings expose `file_path`, `line`, `severity`, `category`, and `description`.
+
+## Run tests
+
+```bash
+PYTHONPATH=src python -m unittest discover -s tests
+```
+
+## License
+
+MIT. See `LICENSE`.

aegis_python_security_scanner-1.0.0/README.md

@@ -0,0 +1,56 @@
+# Aegis Code
+
+A lightweight, local-first Python static application security testing (SAST)
+scanner. Aegis analyzes Python source with the built-in AST module and checks
+text for likely hardcoded secrets.
+
+## Features
+
+- Detects likely hardcoded API keys and tokens.
+- Flags calls to `eval()` and `exec()`.
+- Warns about imports of `pickle`, `telnetlib`, and `xmlrpclib`.
+- Scans source text in memory or reads a Python file from disk.
+- Returns findings as Python objects that can be converted to dictionaries.
+
+## Install
+
+From this directory:
+
+```bash
+python -m pip install -e .
+```
+
+This installs the `aegis` package and the `aegis` command.
+The PyPI distribution name is `aegis-python-security-scanner`; the Python
+import name is `aegis`.
+
+## Scan a file
+
+```bash
+aegis path/to/file.py
+```
+
+## Use the Python API
+
+```python
+from aegis import AegisEngine
+
+engine = AegisEngine()
+findings = engine.scan_code("result = eval(user_input)", file_path="example.py")
+
+for finding in findings:
+    print(finding.to_dict())
+```
+
+`scan_file()` scans a path on disk. `scan_code()` scans a string in memory.
+Findings expose `file_path`, `line`, `severity`, `category`, and `description`.
+
+## Run tests
+
+```bash
+PYTHONPATH=src python -m unittest discover -s tests
+```
+
+## License
+
+MIT. See `LICENSE`.

aegis_python_security_scanner-1.0.0/pyproject.toml

@@ -0,0 +1,3 @@
+[build-system]
+requires = ["setuptools>=61.0", "wheel"]
+build-backend = "setuptools.build_meta"

aegis_python_security_scanner-1.0.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

aegis_python_security_scanner-1.0.0/setup.py

@@ -0,0 +1,32 @@
+from pathlib import Path
+
+from setuptools import find_packages, setup
+
+
+ROOT = Path(__file__).parent
+
+setup(
+    name="aegis-python-security-scanner",
+    version="1.0.0",
+    description="A lightweight, local-first Python SAST security scanner",
+    author="Ahmed Mohamed",
+    url="https://github.com/am9024048-hue/Aegis-code",
+    license="MIT",
+    license_files=["LICENSE"],
+    long_description=(ROOT / "README.md").read_text(encoding="utf-8"),
+    long_description_content_type="text/markdown",
+    package_dir={"": "src"},
+    packages=find_packages(where="src"),
+    python_requires=">=3.8",
+    install_requires=["rich>=13.0.0"],
+    entry_points={
+        "console_scripts": [
+            "aegis=aegis.scanner:main",
+        ],
+    },
+    classifiers=[
+        "Programming Language :: Python :: 3",
+        "Programming Language :: Python :: 3 :: Only",
+        "Topic :: Security",
+    ],
+)

aegis_python_security_scanner-1.0.0/src/aegis/__init__.py

@@ -0,0 +1,21 @@
+"""Aegis Code: a lightweight Python security scanner."""
+
+from .scanner import (
+    AegisEngine,
+    HardcodedSecretsRule,
+    InsecureFunctionsRule,
+    InsecureImportsRule,
+    RichReporter,
+    SecurityRule,
+    Vulnerability,
+)
+
+__all__ = [
+    "AegisEngine",
+    "HardcodedSecretsRule",
+    "InsecureFunctionsRule",
+    "InsecureImportsRule",
+    "RichReporter",
+    "SecurityRule",
+    "Vulnerability",
+]

aegis_python_security_scanner-1.0.0/src/aegis/scanner.py

@@ -0,0 +1,268 @@
+import ast
+import re
+import sys
+from pathlib import Path
+from typing import Any, Dict, List
+
+from rich.console import Console
+from rich.panel import Panel
+from rich.table import Table
+from rich.text import Text
+
+
+class Vulnerability:
+    """Represents a single detected security issue."""
+
+    def __init__(
+        self,
+        file_path: str,
+        line: int,
+        severity: str,
+        category: str,
+        description: str,
+    ):
+        self.file_path = file_path
+        self.line = line
+        self.severity = severity
+        self.category = category
+        self.description = description
+
+    def to_dict(self) -> Dict[str, Any]:
+        """Convert the finding to a dictionary."""
+        return {
+            "file_path": self.file_path,
+            "line": self.line,
+            "severity": self.severity,
+            "category": self.category,
+            "description": self.description,
+        }
+
+
+class SecurityRule:
+    """Base class for all security rules."""
+
+    def analyze_ast(self, tree: ast.AST, file_path: str) -> List[Vulnerability]:
+        return []
+
+    def analyze_regex(self, content: str, file_path: str) -> List[Vulnerability]:
+        return []
+
+
+class HardcodedSecretsRule(SecurityRule):
+    """Detect exposed API keys and sensitive tokens using regular expressions."""
+
+    PATTERNS = [
+        (
+            r'(?i)(api[_-]?key|secret[_-]?key|token|auth[_-]?token)\s*=\s*[\'"][A-Za-z0-9_\-]{16,}[\'"]',
+            "Potential hardcoded API secret / token detected",
+        ),
+        (
+            r"AIzaSy[A-Za-z0-9_\-]{33}",
+            "Google API Key detected",
+        ),
+        (
+            r"sk-[A-Za-z0-9]{32,}",
+            "OpenAI / API Secret Key detected",
+        ),
+    ]
+
+    def analyze_regex(self, content: str, file_path: str) -> List[Vulnerability]:
+        vulnerabilities = []
+        for line_number, line in enumerate(content.splitlines(), 1):
+            for pattern, description in self.PATTERNS:
+                if re.search(pattern, line):
+                    vulnerabilities.append(
+                        Vulnerability(
+                            file_path,
+                            line_number,
+                            "HIGH",
+                            "Hardcoded Secret",
+                            description,
+                        )
+                    )
+        return vulnerabilities
+
+
+class InsecureFunctionsRule(SecurityRule):
+    """Detect dangerous dynamic code execution such as eval() and exec()."""
+
+    def analyze_ast(self, tree: ast.AST, file_path: str) -> List[Vulnerability]:
+        vulnerabilities = []
+        for node in ast.walk(tree):
+            if isinstance(node, ast.Call) and isinstance(node.func, ast.Name):
+                if node.func.id in {"eval", "exec"}:
+                    vulnerabilities.append(
+                        Vulnerability(
+                            file_path,
+                            node.lineno,
+                            "HIGH",
+                            "Dynamic Execution",
+                            f"Use of dangerous function '{node.func.id}' detected",
+                        )
+                    )
+        return vulnerabilities
+
+
+class InsecureImportsRule(SecurityRule):
+    """Warn about imports of insecure or deprecated modules."""
+
+    INSECURE_MODULES = {"pickle", "telnetlib", "xmlrpclib"}
+
+    def analyze_ast(self, tree: ast.AST, file_path: str) -> List[Vulnerability]:
+        vulnerabilities = []
+        for node in ast.walk(tree):
+            if isinstance(node, ast.Import):
+                for alias in node.names:
+                    if alias.name in self.INSECURE_MODULES:
+                        vulnerabilities.append(
+                            Vulnerability(
+                                file_path,
+                                node.lineno,
+                                "MEDIUM",
+                                "Insecure Import",
+                                f"Import of insecure module '{alias.name}' detected",
+                            )
+                        )
+            elif isinstance(node, ast.ImportFrom):
+                if node.module in self.INSECURE_MODULES:
+                    vulnerabilities.append(
+                        Vulnerability(
+                            file_path,
+                            node.lineno,
+                            "MEDIUM",
+                            "Insecure Import",
+                            f"Import from insecure module '{node.module}' detected",
+                        )
+                    )
+        return vulnerabilities
+
+
+class AegisEngine:
+    """Core scanner, independent of the CLI and terminal reporter."""
+
+    def __init__(self):
+        self.rules: List[SecurityRule] = [
+            HardcodedSecretsRule(),
+            InsecureFunctionsRule(),
+            InsecureImportsRule(),
+        ]
+
+    def scan_code(
+        self,
+        content: str,
+        file_path: str = "snippet.py",
+    ) -> List[Vulnerability]:
+        """Scan source code held in memory."""
+        findings = []
+        try:
+            tree = ast.parse(content, filename=file_path)
+            for rule in self.rules:
+                findings.extend(rule.analyze_ast(tree, file_path))
+        except SyntaxError as error:
+            findings.append(
+                Vulnerability(
+                    file_path,
+                    error.lineno or 1,
+                    "HIGH",
+                    "Syntax Error",
+                    f"Unable to parse file: {error.msg}",
+                )
+            )
+
+        for rule in self.rules:
+            findings.extend(rule.analyze_regex(content, file_path))
+
+        return findings
+
+    def scan_file(self, target_path: Path) -> List[Vulnerability]:
+        """Scan a Python source file from disk."""
+        if not target_path.exists():
+            return [
+                Vulnerability(
+                    str(target_path),
+                    0,
+                    "HIGH",
+                    "File Error",
+                    "File does not exist",
+                )
+            ]
+
+        try:
+            content = target_path.read_text(encoding="utf-8")
+            return self.scan_code(content, str(target_path))
+        except Exception as error:
+            return [
+                Vulnerability(
+                    str(target_path),
+                    0,
+                    "HIGH",
+                    "Read Error",
+                    f"Failed to read file: {error}",
+                )
+            ]
+
+
+class RichReporter:
+    """Render scan results in the terminal using Rich."""
+
+    def __init__(self):
+        self.console = Console()
+
+    def print_banner(self):
+        banner_text = Text("AEGIS CODE - SAST Security Scanner", style="bold cyan")
+        self.console.print(Panel(banner_text, border_style="blue", expand=False))
+
+    def render_report(self, findings: List[Vulnerability], file_scanned: str):
+        self.print_banner()
+        self.console.print(
+            f"\n[bold white]Scanned File:[/bold white] "
+            f"[yellow]{file_scanned}[/yellow]\n"
+        )
+
+        if not findings:
+            self.console.print(
+                Panel(
+                    "[bold green]No security issues detected! "
+                    "Your code looks clean.[/bold green]",
+                    border_style="green",
+                )
+            )
+            return
+
+        table = Table(title="Security Findings", show_header=True, header_style="bold magenta")
+        table.add_column("Line", style="dim", width=8, justify="center")
+        table.add_column("Severity", width=12, justify="center")
+        table.add_column("Category", width=20)
+        table.add_column("Description", style="white")
+
+        for finding in findings:
+            severity_style = "bold red" if finding.severity == "HIGH" else "bold yellow"
+            severity_text = (
+                f"[{severity_style}]{finding.severity}[/{severity_style}]"
+            )
+            table.add_row(
+                str(finding.line),
+                severity_text,
+                finding.category,
+                finding.description,
+            )
+
+        self.console.print(table)
+        self.console.print(
+            f"\n[bold red]Total Issues Found: {len(findings)}[/bold red]\n"
+        )
+
+
+def main():
+    """Run the file-scanning command-line interface."""
+    if len(sys.argv) < 2:
+        Console().print(
+            "[bold yellow]Usage:[/bold yellow] aegis <path_to_python_file>"
+        )
+        sys.exit(1)
+
+    target_file = Path(sys.argv[1])
+    engine = AegisEngine()
+    reporter = RichReporter()
+    findings = engine.scan_file(target_file)
+    reporter.render_report(findings, str(target_file))

aegis_python_security_scanner-1.0.0/src/aegis_python_security_scanner.egg-info/PKG-INFO

@@ -0,0 +1,81 @@
+Metadata-Version: 2.4
+Name: aegis-python-security-scanner
+Version: 1.0.0
+Summary: A lightweight, local-first Python SAST security scanner
+Home-page: https://github.com/am9024048-hue/Aegis-code
+Author: Ahmed Mohamed
+License: MIT
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Topic :: Security
+Requires-Python: >=3.8
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: rich>=13.0.0
+Dynamic: author
+Dynamic: classifier
+Dynamic: description
+Dynamic: description-content-type
+Dynamic: home-page
+Dynamic: license
+Dynamic: license-file
+Dynamic: requires-dist
+Dynamic: requires-python
+Dynamic: summary
+
+# Aegis Code
+
+A lightweight, local-first Python static application security testing (SAST)
+scanner. Aegis analyzes Python source with the built-in AST module and checks
+text for likely hardcoded secrets.
+
+## Features
+
+- Detects likely hardcoded API keys and tokens.
+- Flags calls to `eval()` and `exec()`.
+- Warns about imports of `pickle`, `telnetlib`, and `xmlrpclib`.
+- Scans source text in memory or reads a Python file from disk.
+- Returns findings as Python objects that can be converted to dictionaries.
+
+## Install
+
+From this directory:
+
+```bash
+python -m pip install -e .
+```
+
+This installs the `aegis` package and the `aegis` command.
+The PyPI distribution name is `aegis-python-security-scanner`; the Python
+import name is `aegis`.
+
+## Scan a file
+
+```bash
+aegis path/to/file.py
+```
+
+## Use the Python API
+
+```python
+from aegis import AegisEngine
+
+engine = AegisEngine()
+findings = engine.scan_code("result = eval(user_input)", file_path="example.py")
+
+for finding in findings:
+    print(finding.to_dict())
+```
+
+`scan_file()` scans a path on disk. `scan_code()` scans a string in memory.
+Findings expose `file_path`, `line`, `severity`, `category`, and `description`.
+
+## Run tests
+
+```bash
+PYTHONPATH=src python -m unittest discover -s tests
+```
+
+## License
+
+MIT. See `LICENSE`.

aegis_python_security_scanner-1.0.0/src/aegis_python_security_scanner.egg-info/SOURCES.txt

@@ -0,0 +1,13 @@
+LICENSE
+README.md
+pyproject.toml
+setup.py
+src/aegis/__init__.py
+src/aegis/scanner.py
+src/aegis_python_security_scanner.egg-info/PKG-INFO
+src/aegis_python_security_scanner.egg-info/SOURCES.txt
+src/aegis_python_security_scanner.egg-info/dependency_links.txt
+src/aegis_python_security_scanner.egg-info/entry_points.txt
+src/aegis_python_security_scanner.egg-info/requires.txt
+src/aegis_python_security_scanner.egg-info/top_level.txt
+tests/test_package.py

aegis_python_security_scanner-1.0.0/src/aegis_python_security_scanner.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

aegis_python_security_scanner-1.0.0/src/aegis_python_security_scanner.egg-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+aegis = aegis.scanner:main

aegis_python_security_scanner-1.0.0/src/aegis_python_security_scanner.egg-info/requires.txt

@@ -0,0 +1 @@
+rich>=13.0.0

aegis_python_security_scanner-1.0.0/src/aegis_python_security_scanner.egg-info/top_level.txt

@@ -0,0 +1 @@
+aegis

aegis_python_security_scanner-1.0.0/tests/test_package.py

@@ -0,0 +1,62 @@
+import unittest
+
+from aegis import AegisEngine, Vulnerability
+
+
+class AegisEngineTests(unittest.TestCase):
+    def setUp(self):
+        self.engine = AegisEngine()
+
+    def test_finds_dynamic_execution(self):
+        findings = self.engine.scan_code("result = eval(user_input)", "sample.py")
+
+        self.assertTrue(
+            any(
+                finding.category == "Dynamic Execution"
+                and finding.severity == "HIGH"
+                and finding.line == 1
+                for finding in findings
+            )
+        )
+
+    def test_finds_insecure_imports(self):
+        findings = self.engine.scan_code("import pickle", "sample.py")
+
+        self.assertTrue(
+            any(finding.category == "Insecure Import" for finding in findings)
+        )
+
+    def test_finds_hardcoded_secrets(self):
+        findings = self.engine.scan_code(
+            'api_key = "abcdefghijklmnop"',
+            "sample.py",
+        )
+
+        self.assertTrue(
+            any(finding.category == "Hardcoded Secret" for finding in findings)
+        )
+
+    def test_reports_syntax_errors(self):
+        findings = self.engine.scan_code("if:", "sample.py")
+
+        self.assertTrue(
+            any(finding.category == "Syntax Error" for finding in findings)
+        )
+
+    def test_finding_serializes_to_a_dictionary(self):
+        finding = Vulnerability("sample.py", 3, "LOW", "Example", "Example finding")
+
+        self.assertEqual(
+            finding.to_dict(),
+            {
+                "file_path": "sample.py",
+                "line": 3,
+                "severity": "LOW",
+                "category": "Example",
+                "description": "Example finding",
+            },
+        )
+
+
+if __name__ == "__main__":
+    unittest.main()