Cpython Security Toolkit

CPython Security Toolkit

A [Claude Code](https://docs.anthropic.com/en/docs/claude-code) plugin for finding semantic security flaws in CPython's standard library — the class of bug that generic SAST tools, fuzzers, and sanitizers do not model well.

Built around CPython-specific security invariants: archive extraction boundaries, protocol validation coverage, resource amplification ratios, and audit hook gaps. Every detector is anchored to a confirmed historical CVE; every finding requires a runnable reproducer before it reaches a maintainer.

---

⚠️ Read this before you use this toolkit on CPython

This tool finds **security vulnerabilities** in CPython's standard library. Security findings are handled differently from correctness bugs.

• Read WORKING_WITH_MAINTAINERS.md. It is the most important document in this repository.
• Security findings go to security@python.org first — never the public issue tracker. See the CPython security policy.
• Pre-triage with a trusted CPython developer before submitting. One private message — "I found something that might be a security issue in tarfile, can you take a look?" — takes five minutes and saves everyone time.
• Never file a finding without a runnable reproducer. A finding with no reproducer is not a finding. The tool enforces this.
• Concise and objective reports only. CPython maintainers are busy. One clear sentence describing the violated invariant is worth more than three paragraphs of analysis.

---

Why a Separate Tool?

Concern	cpython-review-toolkit	cpython-security-toolkit
Layer	C source (Modules/, Objects/, Python/)	Python stdlib (Lib/)
Question asked	"Is this C implementation correct?"	"Does this stdlib behavior violate a security invariant?"
Bug class	Refcount leaks, null safety, error paths	Archive escapes, validation bypass, resource ampl