Python security scanning for local and CI review.

The problem this page helps clarify

The useful question is where Python changes the review loop: what enters the scan, who acts on a finding, and which evidence moves forward. Python source files (.py, pyproject.toml, requirements.txt, poetry.lock) plus pip, Poetry, and lockfile advisories evidence in one local review path.

• Audience: Developers maintaining Python repositories and their dependency manifests.
• Focus: Python source files (.py, pyproject.toml, requirements.txt, poetry.lock) plus pip, Poetry, and lockfile advisories evidence in one local review path.
• Review question: What does Python cover in practice?

Coverage and concrete signals

For Python, inspect the concrete scope below instead of relying on a category label. File-level source findings, secret checks, dependency advisories, and SARIF-ready output for Python.

• Focus: Python source files (.py, pyproject.toml, requirements.txt, poetry.lock) plus pip, Poetry, and lockfile advisories evidence in one local review path.
• Workflow: Files: .py, pyproject.toml, requirements.txt, poetry.lock
• Coverage and concrete signals: .py, pyproject.toml, requirements.txt, poetry.lock, pip, Poetry, and lockfile advisories, SARIF

From local signal to shared gate.

Python: Use the smallest workflow that proves value. Each later step should reuse evidence the team already understands. Python source files (.py, pyproject.toml, requirements.txt, poetry.lock) plus pip, Poetry, and lockfile advisories evidence in one local review path.

Copyradar scan . --quick
radar scan . --format sarif --fail-on high

Evidence to inspect before you trust the result.

Python: A useful result must be explainable to a developer and portable to the next review surface. Inspect the concrete evidence below before changing team policy. File-level source findings, secret checks, dependency advisories, and SARIF-ready output for Python.

• Files: .py, pyproject.toml, requirements.txt, poetry.lock
• Exact file location, rule context, severity, confidence, and remediation guidance.
• Terminal output, SARIF, JSON, or HTML artifacts generated from the same finding set.
• Source stays in the workspace or CI runner where the scan executes.

Good fit and limits

Use Python when Developers maintaining Python repositories and their dependency manifests. Keep the boundary explicit: Coverage depends on parsers, manifests, lockfiles, and rules; runtime behavior still needs complementary testing.

Run the local proof before adopting a shared gate.

• Good fit: Developers maintaining Python repositories and their dependency manifests.
• Not a fit / do not overreach: Coverage depends on parsers, manifests, lockfiles, and rules; runtime behavior still needs complementary testing.

Questions to verify before rollout

These questions keep the decision tied to observable evidence rather than a broad product promise.