Example: API to retrieve implemented checks

Overview of implemented security checks

This API retrieves the default implemented security validations.

This function collects the built-in Static Application Security Testing (SAST) validations applied to standard Python modules. It retrieves the validation definitions, converts them into a serializable format, and enriches the result with generation metadata.

The returned structure is intended to be consumed by reporting, API, or documentation layers.

from codeaudit.api_interfaces import get_default_validations

get_default_validations()

{'name': 'Python_Code_Audit',
 'version': '1.8.1',
 'generated_on': '2026-07-31 13:23',
 'validations': [{'name': 'Assertions',
   'construct': 'assert',
   'severity': 'Low',
   'info': 'Assertions are for debugging and development. Assertions can be disabled during runtime. Use in production can introduce vulnerabilities.'},
  {'name': 'Insecure Network Binding',
   'construct': 's.bind',
   'severity': 'Medium',
   'info': 'Binding to all interfaces can expose the service to a wider network attack surface.'},
  {'name': 'OS File Permissions',
   'construct': 'os.chmod',
   'severity': 'High',
   'info': 'Changing permissions carelessly can expose sensitive files.'},
  {'name': 'Directory Creation',
   'construct': 'os.makedirs',
   'severity': 'Low',
   'info': 'Direct file system calls require careful input validation to prevent vulnerabilities.'},
  {'name': 'Directory Creation',
   'construct': 'os.mkdir',
   'severity': 'Low',
   'info': 'Direct file system calls require careful input validation to prevent vulnerabilities.'},
  {'name': 'Directory Creation',
   'construct': 'os.mkfifo',
   'severity': 'Low',
   'info': 'Direct file system calls require careful input validation to prevent vulnerabilities.'},
  {'name': 'Directory Creation',
   'construct': 'os.mknod',
   'severity': 'Low',
   'info': 'Direct file system calls require careful input validation to prevent vulnerabilities.'},
  {'name': 'Directory Creation',
   'construct': 'os.makedev',
   'severity': 'Low',
   'info': 'Direct file system calls require careful input validation to prevent vulnerabilities.'},
  {'name': 'OS Forking',
   'construct': 'os.fork',
   'severity': 'Low',
   'info': 'On macOS use of this function is unsafe when mixed with using higher-level system APIs, and that includes using urllib.request.'},
  {'name': 'Dangerous Built-in: eval',
   'construct': 'eval',
   'severity': 'High',
   'info': 'This function can execute arbitrary code. Never safe with untrusted input.'},
  {'name': 'Input Function',
   'construct': 'input',
   'severity': 'Low',
   'info': 'User input must be strictly sanitized and validated to prevent injection vulnerabilities.'},
  {'name': 'Overly Broad Exception Handling',
   'construct': 'pass',
   'severity': 'Low',
   'info': 'Using `pass` in an `except` block can silently ignore critical security exceptions.'},
  {'name': 'Overly Broad Exception Handling',
   'construct': 'continue',
   'severity': 'Low',
   'info': 'Skipping over exceptions can mask critical errors and security risks.'},
  {'name': 'Dangerous Built-in: exec',
   'construct': 'exec',
   'severity': 'High',
   'info': 'This function can execute arbitrary code and should be used only with validated constructs.'},
  {'name': 'Dangerous Built-in: compile',
   'construct': 'compile',
   'severity': 'High',
   'info': 'This function can be used to execute arbitrary code or crash the Python interpreter.'},
  {'name': 'Dynamic Imports',
   'construct': '__import__',
   'severity': 'Medium',
   'info': 'Importing modules dynamically can load untrusted code.'},
  {'name': 'Dynamic Imports',
   'construct': 'importlib.import_module',
   'severity': 'Medium',
   'info': 'Importing modules dynamically can load untrusted code.'},
  {'name': 'Dynamic Imports',
   'construct': 'importlib.util.spec_from_file_location',
   'severity': 'Low',
   'info': 'Can bypass the normal import mechanism and can execute arbitrary Python files.'},
  {'name': 'Dynamic Imports',
   'construct': 'importlib.util.module_from_spec',
   'severity': 'Low',
   'info': 'Can bypass the normal import mechanism and can execute arbitrary Python files.'},
  {'name': 'Insecure Hashing Algorithm',
   'construct': 'hashlib.md5',
   'severity': 'High',
   'info': 'MD5 is cryptographically broken and should not be used for security purposes.'},
  {'name': 'Insecure Hashing Algorithm',
   'construct': 'hashlib.sha1',
   'severity': 'High',
   'info': 'SHA-1 is cryptographically broken and should not be used for security purposes.'},
  {'name': 'Insecure FTP use',
   'construct': 'ftplib.FTP',
   'severity': 'High',
   'info': 'Never use this. Sends usernames and passwords in plain text and transfers data unencrypted. '},
  {'name': 'Logging Configuration',
   'construct': 'logging.config',
   'severity': 'Medium',
   'info': 'Parsing untrusted logging configurations can lead to vulnerabilities if not handled correctly.'},
  {'name': 'Pickle Usage',
   'construct': 'pickle.loads',
   'severity': 'High',
   'info': 'Deserializing untrusted data with `pickle` can lead to arbitrary code execution.'},
  {'name': 'Pickle Usage',
   'construct': 'pickle.load',
   'severity': 'High',
   'info': 'Deserializing untrusted data with `pickle` can lead to arbitrary code execution.'},
  {'name': 'Pickle Usage',
   'construct': 'pickle.Unpickler',
   'severity': 'High',
   'info': 'Deserializing untrusted data with `pickle` can lead to arbitrary code execution.'},
  {'name': 'OS Execution',
   'construct': 'os.system',
   'severity': 'High',
   'info': 'Direct OS function calls can have significant security implications and require careful review.'},
  {'name': 'OS Execution',
   'construct': 'os.execl',
   'severity': 'High',
   'info': 'Direct OS function calls can have significant security implications and require careful review.'},
  {'name': 'OS Execution',
   'construct': 'os.execle',
   'severity': 'High',
   'info': 'Direct OS function calls can have significant security implications and require careful review.'},
  {'name': 'OS Execution',
   'construct': 'os.execlp',
   'severity': 'High',
   'info': 'Direct OS function calls can have significant security implications and require careful review.'},
  {'name': 'OS Execution',
   'construct': 'os.execlpe',
   'severity': 'High',
   'info': 'Direct OS function calls can have significant security implications and require careful review.'},
  {'name': 'OS Execution',
   'construct': 'os.execv',
   'severity': 'High',
   'info': 'Direct OS function calls can have significant security implications and require careful review.'},
  {'name': 'OS Execution',
   'construct': 'os.execve',
   'severity': 'High',
   'info': 'Direct OS function calls can have significant security implications and require careful review.'},
  {'name': 'OS Execution',
   'construct': 'os.execvp',
   'severity': 'High',
   'info': 'Direct OS function calls can have significant security implications and require careful review.'},
  {'name': 'OS Execution',
   'construct': 'os.execvpe',
   'severity': 'High',
   'info': 'Direct OS function calls can have significant security implications and require careful review.'},
  {'name': 'OS Execution',
   'construct': 'os.popen',
   'severity': 'High',
   'info': 'Direct OS function calls can have significant security implications and require careful review.'},
  {'name': 'Sys Calls',
   'construct': 'sys.call_tracing',
   'severity': 'Medium',
   'info': 'Provides low-level access to interpreter execution; dangerous if exposed.'},
  {'name': 'Sys Calls',
   'construct': 'sys.setprofile',
   'severity': 'Medium',
   'info': 'Provides low-level access to interpreter execution; dangerous if exposed.'},
  {'name': 'Sys Calls',
   'construct': 'sys.settrace',
   'severity': 'Medium',
   'info': 'Provides low-level access to interpreter execution; dangerous if exposed.'},
  {'name': 'OS Access',
   'construct': 'os.access',
   'severity': 'High',
   'info': 'Direct OS function calls can have significant security implications and require careful review.'},
  {'name': 'OS File Operations',
   'construct': 'os.write',
   'severity': 'Low',
   'info': 'Writing to unvalidated or unintended file descriptors can lead to data corruption, privilege escalation, or denial of service.'},
  {'name': 'OS File Operations',
   'construct': 'os.writev',
   'severity': 'Low',
   'info': 'Writing to unvalidated or unintended file descriptors can lead to data corruption, privilege escalation, or denial of service.'},
  {'name': 'OS Interfaces',
   'construct': 'os.forkpty',
   'severity': 'Low',
   'info': 'Use of forkpty can be unsafe when used on MacOS.'},
  {'name': 'OS File Operations',
   'construct': 'os.read',
   'severity': 'Low',
   'info': 'Reading from unvalidated file descriptors can lead to information disclosure.'},
  {'name': 'Tempfile',
   'construct': 'tempfile.mktemp',
   'severity': 'Low',
   'info': 'This function is deprecated because of race conditions that can lead to security vulnerabilities.'},
  {'name': 'Marshal Usage',
   'construct': 'marshal.loads',
   'severity': 'High',
   'info': 'This module is not secure and should not be used to deserialize data from untrusted sources.'},
  {'name': 'Marshal Usage',
   'construct': 'marshal.load',
   'severity': 'High',
   'info': 'This module is not secure and should not be used to deserialize data from untrusted sources.'},
  {'name': 'Subprocess Usage',
   'construct': 'subprocess.call',
   'severity': 'High',
   'info': 'Requires careful input validation to prevent command injection vulnerabilities.'},
  {'name': 'Subprocess Usage',
   'construct': 'subprocess.check_call',
   'severity': 'High',
   'info': 'Requires careful input validation to prevent command injection vulnerabilities.'},
  {'name': 'Subprocess Usage',
   'construct': 'subprocess.Popen',
   'severity': 'Medium',
   'info': 'Requires careful input validation to prevent command injection vulnerabilities.'},
  {'name': 'Subprocess Usage',
   'construct': 'subprocess.run',
   'severity': 'Medium',
   'info': 'Requires careful input validation to prevent command injection vulnerabilities.'},
  {'name': 'Subprocess Usage',
   'construct': 'subprocess.check_output',
   'severity': 'Medium',
   'info': 'Requires careful input validation to prevent command injection vulnerabilities.'},
  {'name': 'Subprocess Usage',
   'construct': 'subprocess.getstatusoutput',
   'severity': 'Medium',
   'info': 'Requires careful input validation to prevent command injection vulnerabilities.'},
  {'name': 'Subprocess Usage',
   'construct': 'subprocess.getoutput',
   'severity': 'Medium',
   'info': 'Requires careful input validation to prevent command injection vulnerabilities.'},
  {'name': 'Tarfile Extraction',
   'construct': 'tarfile.TarFile',
   'severity': 'High',
   'info': 'Vulnerable to path traversal attacks if used with untrusted archives.'},
  {'name': 'Base64 Decoding ',
   'construct': 'base64.b64decode',
   'severity': 'Medium',
   'info': 'Base64 encoding/decoding is not for security. It only visually hides data and provides no confidentiality. Often used to obfuscate malware in code.'},
  {'name': 'Base64 Decoding ',
   'construct': 'base64.z85decode',
   'severity': 'Medium',
   'info': 'Base64 encoding/decoding is not for security. It only visually hides data and provides no confidentiality. Often used to obfuscate malware in code.'},
  {'name': 'Base64 Decoding ',
   'construct': 'base64.b85encode',
   'severity': 'Low',
   'info': 'Base64 encoding/decoding is not for security. It only visually hides data and provides no confidentiality. Often used to obfuscate malware in code.'},
  {'name': 'Base64 Decoding ',
   'construct': 'base64.b64encode',
   'severity': 'Low',
   'info': 'Base64 encoding/decoding is not for security. It only visually hides data and provides no confidentiality. Often used to obfuscate malware in code.'},
  {'name': 'XML-RPC Client',
   'construct': 'xmlrpc.client',
   'severity': 'High',
   'info': 'Vulnerable to denial-of-service via decompression bombs.'},
  {'name': 'XML-RPC Server',
   'construct': 'xmlrpc.server.SimpleXMLRPCServer',
   'severity': 'High',
   'info': 'Vulnerable to denial-of-service via decompression bombs.'},
  {'name': 'Cryptographically Unsafe Randomness',
   'construct': 'random.random',
   'severity': 'Low',
   'info': 'The pseudo-random generators in this module are not suitable for security purposes. '},
  {'name': 'Cryptographically Unsafe Randomness',
   'construct': 'random.Random',
   'severity': 'Low',
   'info': 'The pseudo-random generators in this module are not suitable for security purposes. '},
  {'name': 'Cryptographically Unsafe Randomness',
   'construct': 'random.randrange',
   'severity': 'Low',
   'info': 'The pseudo-random generators in this module are not suitable for security purposes. '},
  {'name': 'Cryptographically Unsafe Randomness',
   'construct': 'random.randint',
   'severity': 'Low',
   'info': 'The pseudo-random generators in this module are not suitable for security purposes. '},
  {'name': 'Cryptographically Unsafe Randomness',
   'construct': 'random.uniform',
   'severity': 'Low',
   'info': 'The pseudo-random generators in this module are not suitable for security purposes. '},
  {'name': 'Cryptographically Unsafe Randomness',
   'construct': 'random.triangular',
   'severity': 'Low',
   'info': 'The pseudo-random generators in this module are not suitable for security purposes. '},
  {'name': 'Cryptographically Unsafe Randomness',
   'construct': 'random.seed',
   'severity': 'Low',
   'info': 'The pseudo-random generators in this module are not suitable for security purposes. '},
  {'name': 'Cryptographically Unsafe Randomness',
   'construct': 'random.randbytes',
   'severity': 'Low',
   'info': 'The pseudo-random generators in this module are not suitable for security purposes. '},
  {'name': 'Shelve Usage',
   'construct': 'shelve.open',
   'severity': 'High',
   'info': 'The `shelve` module uses `pickle` internally, making it unsafe for untrusted data.'},
  {'name': 'Shelve Usage',
   'construct': 'shelve.DbfilenameShelf',
   'severity': 'High',
   'info': 'The `shelve` module uses `pickle` internally, making it unsafe for untrusted data.'},
  {'name': 'Unsafe Deserialization: multiprocessing',
   'construct': 'connection.recv',
   'severity': 'High',
   'info': 'Uses pickle, which can execute arbitrary code when receiving data. '},
  {'name': 'Unsafe Deserialization: multiprocessing',
   'construct': 'multiprocessing.connection.Connection',
   'severity': 'High',
   'info': 'Relies on pickle; dangerous with untrusted data. '},
  {'name': 'Zipfile Extraction',
   'construct': 'zipfile.ZipFile',
   'severity': 'High',
   'info': 'Vulnerable to path traversal attacks if used with untrusted archives.'},
  {'name': 'Zstandard (zstd) decompression',
   'construct': 'compression.zstd.open',
   'severity': 'High',
   'info': 'Vulnerable to path traversal attacks if used with untrusted archives.'},
  {'name': 'Zstandard (zstd) decompression',
   'construct': 'compression.zstd.decompress',
   'severity': 'High',
   'info': 'Vulnerable to path traversal attacks if used with untrusted archives.'},
  {'name': 'Gzip File Handling',
   'construct': 'gzip.open',
   'severity': 'Medium',
   'info': 'Risk of decompression bombs or resource exhaustion with untrusted data.'},
  {'name': 'BZ2 File Handling',
   'construct': 'bz2.open',
   'severity': 'Medium',
   'info': 'Decompressing untrusted data can lead to resource exhaustion attacks. '},
  {'name': 'BZ2 File Handling',
   'construct': 'bz2.BZ2File',
   'severity': 'Medium',
   'info': 'Decompressing untrusted data can lead to resource exhaustion attacks. '},
  {'name': 'LZMA File Handling',
   'construct': 'lzma.open',
   'severity': 'Medium',
   'info': 'Risk of decompression bombs or resource exhaustion with untrusted data.'},
  {'name': 'LZMA File Handling',
   'construct': 'lzma.LZMAFile',
   'severity': 'Medium',
   'info': 'Risk of decompression bombs or resource exhaustion with untrusted data.'},
  {'name': 'Shutil Extraction',
   'construct': 'shutil.unpack_archive',
   'severity': 'Medium',
   'info': 'Untrusted archives can contain malicious paths or payloads.'},
  {'name': 'Shutil Copying',
   'construct': 'shutil.copy',
   'severity': 'Medium',
   'info': 'Files may be copied without authorization if paths are not validated.'},
  {'name': 'Shutil Copying',
   'construct': 'shutil.copy2',
   'severity': 'Medium',
   'info': 'Files may be copied without authorization if paths are not validated.'},
  {'name': 'Shutil Copying',
   'construct': 'shutil.copytree',
   'severity': 'Medium',
   'info': 'Files may be copied without authorization if paths are not validated.'},
  {'name': 'Shutil Operations',
   'construct': 'shutil.chown',
   'severity': 'Medium',
   'info': 'Changing file ownership can introduce vulnerabilities.'},
  {'name': 'Shutil Removal',
   'construct': 'shutil.rmtree',
   'severity': 'Medium',
   'info': 'Vulnerable to path traversal attacks if not used carefully.'},
  {'name': 'HTTP Server (Base Handler)',
   'construct': 'http.server.BaseHTTPRequestHandler',
   'severity': 'High',
   'info': 'These modules are for development only and are not secure for production use.'},
  {'name': 'HTTP Server',
   'construct': 'http.server.HTTPServer',
   'severity': 'High',
   'info': 'These modules are for development only and are not secure for production use.'}]}