Original Summary

Hi Hacker News! I built TimeCodeSecurity (TCS), an open-source static security engine for Python.<p>Most existing open-source SAST tools rely on regex patterns or LLMs, leading to high false-positive rates and alert fatigue. TCS takes a compiler-level deterministic approach: it parses Python&#x27;s Abstract Syntax Tree (AST) and tracks dataflow from function parameters directly into sensitive execution sinks (subprocess.run, raw SQL cursors, and path operations).<p>Key highlights: - Deterministic AST taint tracking (Zero regex &#x2F; Zero AI guessing) - Closed-loop remediation: Patches are validated via AST syntax compilation and re-scanned in-memory before touching disk - Chronological visual proof graphs: Source -&gt; Taint -&gt; Sink - Sub-second execution (~700ms)<p>You can run it directly in your terminal:<p><pre><code> pip install git+https:&#x2F;&#x2F;github.com&#x2F;kushigaur3103-svg&#x2F;time-code-security.git tcs scan .&#x2F;your_project --fix </code></pre> GitHub: https:&#x2F;&#x2F;github.com&#x2F;kushigaur3103-svg&#x2F;time-code-security<p>Would love feedback on the AST traversal and in-memory verification approach! https:&#x2F;&#x2F;github.com&#x2F;kushigaur3103-svg&#x2F;time-code-security And that&#x27;s my linkdin link https:&#x2F;&#x2F;www.linkedin.com&#x2F;in&#x2F;ayush-gaur-1488b1420?utm_source=share_via&amp;utm_content=profile&amp;utm_medium=member_android

  • 情报分类：技术学习与提效
  • 分类依据：内容涉及技术、AI、软件工具或工程实践
  • 信息来源：Hacker News 新项目
  • 发布时间：2026/9/19 18:59:22