tiangolo/fastapi
Modern async Python web framework with rich type annotations.
- Upstream: fastapi
- Pinned commit:
e54e5a8980ffa6d7ff68ee7b25a1c46036375521 - Reference: 0.136.1 release tag
- Scan run: 2026-05-18T00:40:23Z (brass commit
89903723)
Headline metrics
- Total findings: 848
- Critical issues (top-N AI output): 50
- Scan wall time (aggregate scanner-seconds): 584.45 s
- Pysa cache size: 0.0 MB
Severity breakdown
| Severity | Count |
|---|---|
| high | 431 |
| medium | 163 |
| critical | 146 |
| low | 108 |
Scanner contribution
| Scanner | Findings | Share |
|---|---|---|
PhantomAICodeScanner | 306 | 36.1% |
auth_pattern_analyzer | 294 | 34.7% |
SecretsScanner | 95 | 11.2% |
Brass2PrivacyScanner | 80 | 9.4% |
BrassPerformanceScanner | 37 | 4.4% |
AIContextCoherenceScanner | 20 | 2.4% |
ContentModerationScanner | 16 | 1.9% |
Reproduce locally
git clone https://github.com/<owner>/fastapi.git
cd fastapi && git checkout e54e5a8980ffa6d7ff68ee7b25a1c46036375521
brasscoders --offline scan .Numbers from your local run may differ slightly (Python version, scanner version pins) — published baselines are recorded from the canonical CI environment (Ubuntu, Python 3.12, dev-pinned scanner versions). The ±20% findings tolerance and ≤50% wall-time tolerance are wide enough to absorb normal environment drift.