pallets/flask
Mature, professionally-audited Python web framework.
- Upstream: flask
- Pinned commit:
22d924701a6ae2e4cd01e9a15bbaf3946094af65 - Reference: 3.1.3 release tag
- Scan run: 2026-05-17T23:50:35Z (brass commit
a208eb8b)
Headline metrics
- Total findings: 370
- Critical issues (top-N AI output): 50
- Scan wall time (aggregate scanner-seconds): 161.42 s
- Pysa cache size: 0.0 MB
Severity breakdown
| Severity | Count |
|---|---|
| critical | 201 |
| medium | 78 |
| high | 57 |
| low | 34 |
Scanner contribution
| Scanner | Findings | Share |
|---|---|---|
PhantomAICodeScanner | 297 | 80.3% |
auth_pattern_analyzer | 24 | 6.5% |
AIContextCoherenceScanner | 20 | 5.4% |
SecretsScanner | 9 | 2.4% |
BrassPerformanceScanner | 8 | 2.2% |
ContentModerationScanner | 5 | 1.4% |
Brass2PrivacyScanner | 4 | 1.1% |
PysaTaintScanner | 2 | 0.5% |
bandit | 1 | 0.3% |
Reproduce locally
git clone https://github.com/<owner>/flask.git
cd flask && git checkout 22d924701a6ae2e4cd01e9a15bbaf3946094af65
brasscoders --offline scan .Numbers from your local run may differ slightly (Python version, scanner version pins) — published baselines are recorded from the canonical CI environment (Ubuntu, Python 3.12, dev-pinned scanner versions). The ±20% findings tolerance and ≤50% wall-time tolerance are wide enough to absorb normal environment drift.