codeaudit 1.7.0__tar.gz → 1.8.0__tar.gz

{codeaudit-1.7.0 → codeaudit-1.8.0}/CHANGELOG.md

@@ -1,5 +1,50 @@
 # Change Log
 
+## Version 1.8.0:
+
+
+**Added**
+
+* **Security Checks:** Added checks for `importlib.util.spec_from_file_location` and `importlib.util.module_from_spec` to mitigate recent CVE-2026-40156 vulnerabilities.
+* **Configuration:** Added `[tool.pytest]` section to `pyproject.toml`.
+
+**Changed**
+
+* **CLD Output for checks overview:** Sorted the `codeaudit` checks output now alphabetically by `Name`.
+* **Security:** Updated the secret list used for egress detection.
+
+**Fixed**
+
+* **Configuration:** Added the missing `homepage` field under `[project.urls]` in `pyproject.toml`.
+
+**Documentation**
+
+* **CLI Help:** Added help documentation for the CI command (`cimode`). *Big thanks to @jurgenwigg for [pull request #25](https://github.com/nocomplexity/codeaudit/pull/25)!*
+
+## Version 1.7.1:
+
+
+**Added**
+
+* **PyPI Update Indicator:** Added an indicator for the last update of PyPI packages, implemented for both the CLI version and the Dashboard version.
+* **Test Coverage:** Added extra tests to improve codebase stability.
+* **Dashboard Overview (WASM version):** The total number of weaknesses is now displayed directly in the overview tab.
+
+**Changed**
+
+* **CLI Report Optimization (Modules):** The CLI report now only displays modules when they are actually found.
+* **CLI Report Optimization (Tips):** The CLI report now only displays the tip to check external modules for vulnerabilities if vulnerabilities are actually present in a file.
+
+
+**Fixed**
+
+* **Windows 11 Compatibility:** Fixed an issue to ensure `codeaudit overview` works properly on Windows 11, specifically resolving a bug in the `count_lines_iterate` function.
+* **Altair Visuals:** Fixed stability issues with the Altair Visual overview in the `codeaudit overview` section, making it stable again.
+
+**Documentation**
+
+* General documentation updates and minor fixes.
+
 ## Version 1.7.0:
 
 **Added**

{codeaudit-1.7.0 → codeaudit-1.8.0}/PKG-INFO

@@ -1,7 +1,8 @@
 Metadata-Version: 2.4
 Name: codeaudit
-Version: 1.7.0
+Version: 1.8.0
 Summary: A modern Python security source code analyzer (SAST) based on distrust.
+Project-URL: Homepage, https://codeaudit.nocomplexity.com
 Project-URL: Documentation, https://github.com/nocomplexity/codeaudit#readme
 Project-URL: Issues, https://github.com/nocomplexity/codeaudit/issues
 Project-URL: Source, https://github.com/nocomplexity/codeaudit
@@ -44,17 +45,17 @@ Description-Content-Type: text/markdown
 [![License](https://img.shields.io/badge/License-GPLv3-FFD700)](https://nocomplexity.com/documents/codeaudit/license.html)
 [![PyPI Downloads](https://static.pepy.tech/badge/codeaudit)](https://pepy.tech/projects/codeaudit)
 
-Python Code Audit - A modern Python source code analyzer based on distrust.
-
-Python Code Audit is a tool to find **security weaknesses** in Python code. This static application security testing (SAST) tool has **great** features to simplify the necessary security tasks and make it fun and easy. 
+Python Code Audit - A modern Python security source code analyzer based on distrust.
 
+Python Code Audit is a static application security testing (SAST) tool designed to identify **security weaknesses** in Python source code. It combines **powerful analysis features** with an intuitive workflow, making essential security audits both simple and engaging.
 
 This tool is designed for anyone who uses or creates Python programs and wants to understand and mitigate potential security risks.
 
 This tool is created for:
-* Python Users who want to assess the security risks in the Python code they use.
-* Python Developers: Anyone, from professionals to hobbyists, who wants to deliver secure Python code.
-* Security-Conscious Users: People seeking a simple, fast way to gain insight into potential security vulnerabilities within Python packages or files.
+
+- Python Users who want to assess the security risks in the Python code they use.
+- Python Developers: Anyone, from professionals to hobbyists, who wants to deliver secure Python code.
+- Security-Conscious Users: People seeking a simple, fast way to gain insight into potential security vulnerabilities within Python packages or files.
 
 Creating secure software can be challenging. This tool, with its comprehensive [documentation](https://nocomplexity.com/documents/codeaudit/intro.html), acts as your helpful security colleague, making it easier to identify and address vulnerabilities.
 
@@ -62,39 +63,41 @@ Creating secure software can be challenging. This tool, with its comprehensive [
 
 Python Code Audit has the following features:
 
-* **Vulnerability Detection**: Identifies security vulnerabilities in Python files, essential for package security research.
-
-* **Complexity & Statistics**: Reports security-relevant complexity using a fast, lightweight [cyclomatic complexity](https://en.wikipedia.org/wiki/Cyclomatic_complexity) count via Python's AST.
-
-* **Module Usage & External Vulnerabilities**: Detects used modules and reports known vulnerabilities for used external modules.
+- **Vulnerability Detection**: Identifies security vulnerabilities in Python files, essential for package security research.
 
-* **Inline Issue Reporting**: Shows potential security issues with line numbers and code snippets.
+- **Complexity & Statistics**: Reports security-relevant complexity using a fast, lightweight [cyclomatic complexity](https://en.wikipedia.org/wiki/Cyclomatic_complexity) count via Python's AST.
 
+- **Module Usage & External Vulnerabilities**: Detects used modules and reports known vulnerabilities for used external modules.
 
-* **External Egress Detection**: Identifies embedded API keys and logic that enables communication with remote services, helping uncover hidden data exfiltration paths.
+- **Inline Issue Reporting**: Shows potential security issues with line numbers and code snippets.
 
+- **External Egress Detection**: Identifies embedded API keys and logic that enables communication with remote services, helping uncover hidden data exfiltration paths.
 
-* **HTML Reports**: All output is saved in simple, static HTML reports viewable in any browser.
-
+- **CI/CD Ready:** Integrates seamlessly into any CI/CD workflow.
 
+- **HTML Reports**: All output is saved in simple, static HTML reports viewable in any browser.
 
 > [!NOTE]
 > Python Code Audit uses the Python's Abstract Syntax Tree (AST) to get robust and reliable result. Using the Python AST makes contextual Vulnerability Detection possible and false positive are minimized.
 
-
 ## Installation
 
-```console
-pip install -U codeaudit
-```
+> [!TIP]
+> Try it instantly—no installs, no setup, no excuses.
+>
+> 👉 Launch the browser version [here](https://nocomplexity.com/codeauditapp/dashboardapp.html)
 
-If you would like to test this security tool without installing it, simply use the WASM version [available here](https://nocomplexity.com/codeauditapp/dashboardapp.html).
+It runs 100% locally in your browser using WebAssembly (WASM). See the power of the tool in under 60 seconds.
+No downloads. No dependencies. Just click and do a security audit on Python Code.
 
+Loved the browser version? Unlock the full power. For advanced security code inspections, CI/CD integration, and all professional features, install the complete Python package:
 
+```console
+pip install -U codeaudit
+```
 
 If you have installed **Python Code Audit** previously and want to ensure you are using the latest validations and features, simply run this command again. Python Code Audit is frequently updated with new checks.
 
-
 ## Usage
 
 After installation you can get an overview of all implemented commands. Just type in your terminal:
@@ -107,7 +110,7 @@ This will show all commands:
 
 ```text
 ----------------------------------------------------
- _                    __             _             
+ _                    __             _
 |_) \/_|_|_  _ __    /   _  _| _    |_|    _| o _|_
 |   /  |_| |(_)| |   \__(_)(_|(/_   | ||_|(_| |  |_
 ----------------------------------------------------
@@ -116,13 +119,14 @@ Python Code Audit - A modern Python security source code analyzer based on distr
 
 
 Commands to evaluate Python source code:
-Usage: codeaudit COMMAND <directory|package>  [report.html] 
+Usage: codeaudit COMMAND <directory|package>  [report.html]
 
 Depending on the command, you must specify a local directory, a Python file, or a package name hosted on PyPI.org.Reporting: The results are generated as a static HTML report for viewing in a web browser.
 
 Commands:
   overview             Generates an overview report of code complexity and security indicators.
   filescan             Scans Python source code or PyPI packages for security weaknesses.
+  cimode               Run a SAST scan for CI workflows.
   modulescan           Generate a report on known vulnerabilities in Python modules and packages.
   checks               Creates an HTML report of all implemented security checks.
   version              Prints the module version. Or use codeaudit [-v] [--v] [-version] or [--version].
@@ -132,7 +136,7 @@ Use the Python Code Audit documentation (https://codeaudit.nocomplexity.com) to
 
 ## Example
 
-By running the `codeaudit filescan` command, detailed security information is determined for a Python file based on more than **80 validations** implemented. 
+By running the `codeaudit filescan` command, detailed security information is determined for a Python file based on more than **89 validations** implemented.
 
 The `codeaudit filescan` command shows all **potential** security issues that are detected in the source file in a HTML-report.
 
@@ -154,19 +158,17 @@ Paste the line below directly into your browser bar:
 
 ![Example view of filescan report](filescan.png)
 
-
 ## Contributing
 
 All contributions are welcome! Think of corrections on the documentation, code or more and better tests.
 
 Simple Guidelines:
 
-* Questions, Feature Requests, Bug Reports please use on the Github Issue Tracker.
+- Questions, Feature Requests, Bug Reports please use on the Github Issue Tracker.
 
-**Pull Requests are welcome!** 
-
-When you contribute to Codeaudit, your contributions are made under the same license as the file you are working on. 
+**Pull Requests are welcome!**
 
+When you contribute to Codeaudit, your contributions are made under the same license as the file you are working on.
 
 > [!NOTE]
 > This is an open community driven project. Contributors will be mentioned in the [documentation](https://nocomplexity.com/documents/codeaudit/intro.html).
@@ -175,7 +177,4 @@ We adopt the [Collective Code Construction Contract(C4)](https://rfc.zeromq.org/
 
 ## License
 
-
 `codeaudit` is distributed under the terms of the [GPL-3.0-or-later](https://spdx.org/licenses/GPL-3.0-or-later.html) license.
-
-

{codeaudit-1.7.0 → codeaudit-1.8.0}/README.md

@@ -10,17 +10,17 @@
 [![License](https://img.shields.io/badge/License-GPLv3-FFD700)](https://nocomplexity.com/documents/codeaudit/license.html)
 [![PyPI Downloads](https://static.pepy.tech/badge/codeaudit)](https://pepy.tech/projects/codeaudit)
 
-Python Code Audit - A modern Python source code analyzer based on distrust.
-
-Python Code Audit is a tool to find **security weaknesses** in Python code. This static application security testing (SAST) tool has **great** features to simplify the necessary security tasks and make it fun and easy. 
+Python Code Audit - A modern Python security source code analyzer based on distrust.
 
+Python Code Audit is a static application security testing (SAST) tool designed to identify **security weaknesses** in Python source code. It combines **powerful analysis features** with an intuitive workflow, making essential security audits both simple and engaging.
 
 This tool is designed for anyone who uses or creates Python programs and wants to understand and mitigate potential security risks.
 
 This tool is created for:
-* Python Users who want to assess the security risks in the Python code they use.
-* Python Developers: Anyone, from professionals to hobbyists, who wants to deliver secure Python code.
-* Security-Conscious Users: People seeking a simple, fast way to gain insight into potential security vulnerabilities within Python packages or files.
+
+- Python Users who want to assess the security risks in the Python code they use.
+- Python Developers: Anyone, from professionals to hobbyists, who wants to deliver secure Python code.
+- Security-Conscious Users: People seeking a simple, fast way to gain insight into potential security vulnerabilities within Python packages or files.
 
 Creating secure software can be challenging. This tool, with its comprehensive [documentation](https://nocomplexity.com/documents/codeaudit/intro.html), acts as your helpful security colleague, making it easier to identify and address vulnerabilities.
 
@@ -28,39 +28,41 @@ Creating secure software can be challenging. This tool, with its comprehensive [
 
 Python Code Audit has the following features:
 
-* **Vulnerability Detection**: Identifies security vulnerabilities in Python files, essential for package security research.
-
-* **Complexity & Statistics**: Reports security-relevant complexity using a fast, lightweight [cyclomatic complexity](https://en.wikipedia.org/wiki/Cyclomatic_complexity) count via Python's AST.
-
-* **Module Usage & External Vulnerabilities**: Detects used modules and reports known vulnerabilities for used external modules.
+- **Vulnerability Detection**: Identifies security vulnerabilities in Python files, essential for package security research.
 
-* **Inline Issue Reporting**: Shows potential security issues with line numbers and code snippets.
+- **Complexity & Statistics**: Reports security-relevant complexity using a fast, lightweight [cyclomatic complexity](https://en.wikipedia.org/wiki/Cyclomatic_complexity) count via Python's AST.
 
+- **Module Usage & External Vulnerabilities**: Detects used modules and reports known vulnerabilities for used external modules.
 
-* **External Egress Detection**: Identifies embedded API keys and logic that enables communication with remote services, helping uncover hidden data exfiltration paths.
+- **Inline Issue Reporting**: Shows potential security issues with line numbers and code snippets.
 
+- **External Egress Detection**: Identifies embedded API keys and logic that enables communication with remote services, helping uncover hidden data exfiltration paths.
 
-* **HTML Reports**: All output is saved in simple, static HTML reports viewable in any browser.
-
+- **CI/CD Ready:** Integrates seamlessly into any CI/CD workflow.
 
+- **HTML Reports**: All output is saved in simple, static HTML reports viewable in any browser.
 
 > [!NOTE]
 > Python Code Audit uses the Python's Abstract Syntax Tree (AST) to get robust and reliable result. Using the Python AST makes contextual Vulnerability Detection possible and false positive are minimized.
 
-
 ## Installation
 
-```console
-pip install -U codeaudit
-```
+> [!TIP]
+> Try it instantly—no installs, no setup, no excuses.
+>
+> 👉 Launch the browser version [here](https://nocomplexity.com/codeauditapp/dashboardapp.html)
 
-If you would like to test this security tool without installing it, simply use the WASM version [available here](https://nocomplexity.com/codeauditapp/dashboardapp.html).
+It runs 100% locally in your browser using WebAssembly (WASM). See the power of the tool in under 60 seconds.
+No downloads. No dependencies. Just click and do a security audit on Python Code.
 
+Loved the browser version? Unlock the full power. For advanced security code inspections, CI/CD integration, and all professional features, install the complete Python package:
 
+```console
+pip install -U codeaudit
+```
 
 If you have installed **Python Code Audit** previously and want to ensure you are using the latest validations and features, simply run this command again. Python Code Audit is frequently updated with new checks.
 
-
 ## Usage
 
 After installation you can get an overview of all implemented commands. Just type in your terminal:
@@ -73,7 +75,7 @@ This will show all commands:
 
 ```text
 ----------------------------------------------------
- _                    __             _             
+ _                    __             _
 |_) \/_|_|_  _ __    /   _  _| _    |_|    _| o _|_
 |   /  |_| |(_)| |   \__(_)(_|(/_   | ||_|(_| |  |_
 ----------------------------------------------------
@@ -82,13 +84,14 @@ Python Code Audit - A modern Python security source code analyzer based on distr
 
 
 Commands to evaluate Python source code:
-Usage: codeaudit COMMAND <directory|package>  [report.html] 
+Usage: codeaudit COMMAND <directory|package>  [report.html]
 
 Depending on the command, you must specify a local directory, a Python file, or a package name hosted on PyPI.org.Reporting: The results are generated as a static HTML report for viewing in a web browser.
 
 Commands:
   overview             Generates an overview report of code complexity and security indicators.
   filescan             Scans Python source code or PyPI packages for security weaknesses.
+  cimode               Run a SAST scan for CI workflows.
   modulescan           Generate a report on known vulnerabilities in Python modules and packages.
   checks               Creates an HTML report of all implemented security checks.
   version              Prints the module version. Or use codeaudit [-v] [--v] [-version] or [--version].
@@ -98,7 +101,7 @@ Use the Python Code Audit documentation (https://codeaudit.nocomplexity.com) to
 
 ## Example
 
-By running the `codeaudit filescan` command, detailed security information is determined for a Python file based on more than **80 validations** implemented. 
+By running the `codeaudit filescan` command, detailed security information is determined for a Python file based on more than **89 validations** implemented.
 
 The `codeaudit filescan` command shows all **potential** security issues that are detected in the source file in a HTML-report.
 
@@ -120,19 +123,17 @@ Paste the line below directly into your browser bar:
 
 ![Example view of filescan report](filescan.png)
 
-
 ## Contributing
 
 All contributions are welcome! Think of corrections on the documentation, code or more and better tests.
 
 Simple Guidelines:
 
-* Questions, Feature Requests, Bug Reports please use on the Github Issue Tracker.
+- Questions, Feature Requests, Bug Reports please use on the Github Issue Tracker.
 
-**Pull Requests are welcome!** 
-
-When you contribute to Codeaudit, your contributions are made under the same license as the file you are working on. 
+**Pull Requests are welcome!**
 
+When you contribute to Codeaudit, your contributions are made under the same license as the file you are working on.
 
 > [!NOTE]
 > This is an open community driven project. Contributors will be mentioned in the [documentation](https://nocomplexity.com/documents/codeaudit/intro.html).
@@ -141,7 +142,4 @@ We adopt the [Collective Code Construction Contract(C4)](https://rfc.zeromq.org/
 
 ## License
 
-
 `codeaudit` is distributed under the terms of the [GPL-3.0-or-later](https://spdx.org/licenses/GPL-3.0-or-later.html) license.
-
-

{codeaudit-1.7.0 → codeaudit-1.8.0}/docs/CONTRIBUTE.md

@@ -22,6 +22,8 @@ These are all activities we’d like to get help with :
 - Website design and development
 :::
 
+Or just make a [donation](donate-label)!
+
 The **Codeaudit** code repository is hosted at [Github](https://github.com/nocomplexity/codeaudit).
 
 Simple Guidelines:

{codeaudit-1.7.0 → codeaudit-1.8.0}/docs/_config.yml

@@ -4,9 +4,8 @@
 # Created by Maikel Mardjan (nocomplexity.com)
 #######################################################################################
 # Book settings
-#title                       : SimplifiedNLP Documentation # The title of the book. Will be placed in the left navbar.
 title : ""
-author                      : '<a href="https://nocomplexity.com/">Maikel Mardjan (nocomplexity.com)</a>  and all contributors.' # The author of the book
+author                      : '<a href="https://nocomplexity.com/">Maikel Mardjan (nocomplexity.com)</a>  and all contributors.' 
 copyright                   : '2025- Maikel Mardjan - Business Management Support Foundation'  # Copyright year to be placed in the footer
 logo                        : "images/nocxbanner.png"  # A path to the book logo
 # Patterns to skip when building the book. Can be glob-style (e.g. "*skip.ipynb")

{codeaudit-1.7.0 → codeaudit-1.8.0}/docs/_toc.yml

@@ -68,9 +68,7 @@ parts:
  
 
 - caption: Architecture 
-  chapters:     
-  #- file: astlines
-  # - file: astlines2  
+  chapters:       
   - file: architecture
   - file: makeitbetter
   - file: project_philosophy  

{codeaudit-1.7.0 → codeaudit-1.8.0}/docs/about.md

@@ -19,14 +19,14 @@ Currently, I lead initiatives at NoComplexity.com, an innovative IT company focu
 :gutter: 3 
 
 :::{grid-item-card}
-:link: https://nocomplexity.com/documents/securityarchitecture/introduction.html
+:link: https://securitytesting.nocomplexity.com/
 :link-type: url
-{octicon}`book;2em;caption-text` **Open Security Reference Architecture**        
+{octicon}`book;2em;caption-text` **Mastering Security Testing for Python**        
 ^^^
-Cyber security can still be simple and effective.
-Use this Playbook to create better and faster security solutions for your security use case.
+Gain a deep understanding of the methodologies and specialised tools to conduct security validation for Python applications.
 :::
 
+
 :::{grid-item-card}
 :link: http://securitybydesign.nocomplexity.com/
 :link-type: url
@@ -37,31 +37,32 @@ Master the topic quickly with this eBook.
 :::
 
 :::{grid-item-card}
-:link: https://nocomplexity.com/documents/securitysolutions/intro.html
+:link: https://nocomplexity.com/documents/reports/SimplifySecurity.pdf
 :link-type: url
-{octicon}`book;2em;caption-text` **Open Security Solutions**        
+{octicon}`book;2em;caption-text` **Simplify Cyber Manifest**        
 ^^^
-Given the vast array of FOSS cybersecurity products available, this publication offers a handcrafted curated selection.
+A manifesto to revolutionize cybersecurity through simplification.
 :::
 
+
 :::{grid-item-card}
-:link: https://nocomplexity.com/documents/reports/SimplifySecurity.pdf
+:link: https://nocomplexity.github.io/pythonsecurity/
 :link-type: url
-{octicon}`book;2em;caption-text` **Simplify Cyber Manifest**        
+{octicon}`book;2em;caption-text` **Python Security Handbook**        
 ^^^
-A manifesto to revolutionize cybersecurity through simplification.
+This book will give you a deep understanding of how to develop secure Python applications. It also equips you with the knowledge needed to assess the security of Python code written by others.
 :::
 
 
 :::{grid-item-card}
-:link: https://nocomplexity.com/documents/simplifysecurity/intro.html#
+:link: https://nocomplexity.com/documents/securityarchitecture/introduction.html
 :link-type: url
-{octicon}`book;2em;caption-text` **Simplify Security**        
+{octicon}`book;2em;caption-text` **Open Security Reference Architecture**        
 ^^^
-Find open simple cyber solutions that work. Simplify cyber security to accelerate its effectiveness.
+Cyber security can still be simple and effective.
+Use this Playbook to create better and faster security solutions for your security use case.
 :::
 
-
 :::{grid-item-card}
 :link: https://nocomplexity.com/documents/simplifyprivacy/intro.html
 :link-type: url
@@ -71,6 +72,15 @@ This digital Playbook is all about protecting *your* digital privacy.
 :::
 
 
+:::{grid-item-card}
+:link: https://nocomplexity.com/documents/securitysolutions/intro.html
+:link-type: url
+{octicon}`book;2em;caption-text` **Open Security Solutions**        
+^^^
+Given the vast array of FOSS cybersecurity products available, this publication offers a handcrafted curated selection.
+:::
+
+
 ::::
 % End of Cards grid
 

{codeaudit-1.7.0 → codeaudit-1.8.0}/docs/architecture.md

@@ -56,13 +56,19 @@ We focus on delivering a simple, trustworthy security tool that performs its def
 
 The following design choices have been made for Python Code Audit:
 
-* **The Python AST library is used for complex validations.**  
+* **The Python AST library is used to determine weaknesses and perform code validation.**  
   * **Rationale:** As we are creating a Python-specific security checker, using the `ast` module provides **significant** advantages:  
     1. Code is not executed during examination, which is a major benefit when validating potentially malicious code.  
     2. Implementing basic checks using complex regex patterns would make the code and its maintenance unnecessarily difficult.  
     3. Users can add extra validations in a simple, straightforward manner.  
+
++++
+
 * **Python Code Audit is not designed for identifying weaknesses in web applications.**  
   * **Rationale:** We check Python source code, but do not perform XSS or SQL injection checks. Every Python web application **should** use a battle-tested FOSS framework that prevents these vulnerabilities by design. Testing for these would require building a fuzzer rather than a static code scanner. There are other tools that **must** always be used for validating web applications.  
+
++++
+
 * **Postpone code performance optimisations until truly necessary.**  
   * **Rationale:** We aim for a loosely coupled architecture of key functions; performance optimisations can be introduced at a later stage if required. In practice, performance optimisations are rarely needed. Most time will be spent by humans analysing results before deciding whether to use a Python package, or making security improvements to their own code. The baseline performance for scanning a 10MB Python package should be the priority.  
   * **Implication:** Ensure that performance optimisations can be applied later to specific functional blocks if they are found to be causing bottlenecks for users.

{codeaudit-1.7.0 → codeaudit-1.8.0}/docs/checks/assert_check.md

@@ -129,3 +129,7 @@ For robust validation and error handling in production code, always use standard
 * [The assert statement - Python Documentation](https://docs.python.org/3/reference/simple_stmts.html#the-assert-statement)
 * [The dangers of assert in Python](https://snyk.io/blog/the-dangers-of-assert-in-python/)
 * [Feature: Python assert should be consider harmful](https://community.sonarsource.com/t/feature-python-assert-should-be-consider-harmful/38501) But note that Sonar did not implement this check.
+* [CVE-2017-1000433](https://nvd.nist.gov/vuln/detail/CVE-2017-1000433) and see the related [issues/451](https://github.com/IdentityPython/pysaml2/issues/451) 
+* [Advisory: pysaml2 Improper Authentication vulnerability](https://github.com/advisories/GHSA-924m-4pmx-c67h) 
+
+* [Rethinking Python Asserts in SAST](https://nocomplexity.com/python-asserts/)

{codeaudit-1.7.0 → codeaudit-1.8.0}/docs/checks/dynamicimport_check.md

@@ -6,7 +6,8 @@ Especially if you can not validate upfront what is imported.
 Python Code Audit checks on:
 * `__import__`: This builtin function SHOULD never be used anymore. This is an advanced function that is not needed in everyday Python programming. 
 * `importlib.import_module` use. Using this function should be validated upfront.
-
+* `importlib.util.spec_from_file_location`
+* `importlib.util.module_from_spec`
 
 Using the dynamic imports can be a potential security issue, especially when the module name comes from an untrusted source. Often modules are fetches from internet or are imported by cleaver user input constructs in the code. But an attacker could also import the `os` module and then find a way to call functions to run commands on the system. 
 
@@ -26,6 +27,10 @@ This offers a better way to handle dynamic imports. Avoid using `__import__`.
 
 * Using `importlib.import_module()` keeps dynamic import logic contained within the `importlib module`, which is maintained by the core Python developers. This is from a security point of view  preferred over directly using the low-level built-in function `__import__`.
 
+* Using `importlib.util.spec_from_file_location()` in combination with `importlib.util.module_from_spec` can bypass the normal Python import mechanism and allow arbitrary Python files to be executed. 
+
+
+
 ## Mitigation
 
 There is always a security risk when `importlib.import_module()` is used. 
@@ -37,6 +42,11 @@ Possible mitigations:
 * If you do not trust it: Call a security expert to help you! See the [sponsor](../sponsors) page for companies that could help you!
 
 
+While `importlib.util.spec_from_file_location` is frequently seen in legacy plugin systems, it carries substantial security risks. Modern Python plugin architectures provide much safer mechanisms to prevent the execution of arbitrary files from untrusted locations.
+
+
 ## References
 
-* https://docs.python.org/3/library/functions.html#import__ 
+* https://docs.python.org/3/library/functions.html#import__ 
+* [CVE-2026-40156](https://nvd.nist.gov/vuln/detail/CVE-2026-40156) and see all [details](https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-2g3w-cpc4-chr4).
+* [Python Security Handbook](https://nocomplexity.github.io/pythonsecurity/)

{codeaudit-1.7.0 → codeaudit-1.8.0}/docs/checks/exception_check.md

@@ -1,6 +1,6 @@
 ## Exception Statements
 
-Codeaudit detects the use of `pass` within an `except` block.
+Python Code Audit  detects the use of `pass` within an `except` block.
 
 The Python pattern:
 ```python
@@ -10,7 +10,7 @@ except Exception:
     pass
 ```
 
-presents potential security risks due to:
+Presents potential security risks due to:
 - **Overly broad exception handling** – catching `Exception` masks virtually all errors
 - **Silent failure** – using `pass` suppresses all evidence that something went wrong
 
@@ -21,10 +21,16 @@ This security concern also applies when using `continue` inside an exception blo
 - `pass` statements in exception clauses
 - `continue` statements in exception clauses
 
+:::{important} 
+Treat the detection of `pass` and `continue` in exception handlers as a **signal** rather than proof of a security issue. Always examine whether the exception handler catches exceptions that are too broad (for example, `except:` or `except Exception:`).
+
+No static analysis tool can determine with 100% confidence whether a particular exception handler represents a security risk. Due to Python's dynamic nature. The intent of the code, the surrounding context, and the runtime behavior all influence whether suppressing an exception is appropriate.
+:::
+
 
 ## Background
 
-Checking exception statements in Python code for possible security issues should be done.
+Checking exception statements in Python code for possible security issues should always be done.
 Reasons are e.g.:
 
 1.  **Masking of Critical Errors and Vulnerabilities:**
@@ -66,8 +72,11 @@ Reasons are e.g.:
         # Optionally, re-raise the exception if the program cannot continue meaningfully
         # raise
     ```
+
   * **Avoid `pass`:** Only use `pass` if the exception is truly expected and handling it means doing nothing, and you have documented why that's the case. Such scenarios are rare.
+
   * **Use `finally` for Cleanup:** If resources need to be released regardless of whether an exception occurs, use a `finally` block or context managers (`with` statements).
+
     ```python
     try:
         f = open("my_file.txt", "r")
@@ -92,3 +101,4 @@ Reasons are e.g.:
 ## More info
 
 * [CWE-703: Improper Check or Handling of Exceptional Conditions](https://cwe.mitre.org/data/definitions/703.html)
+* [Python Security Handbook, Exception Statements](https://nocomplexity.github.io/pythonsecurity/constructs/exceptions/)