How Long Does a BrassCoders Scan Take?
A typical BrassCoders scan runs in under 60 seconds on most Python codebases. Scan time scales with project size and whether Pyre/Pysa taint analysis is enabled.
Under 60 Seconds on a Typical Codebase
BrassCoders’s full 12-scanner suite runs in under 60 seconds on most Python projects — fast enough for a pull-request CI check without adding meaningful latency to the merge queue.
The CI configuration in BrassCoders’s own documentation targets ubuntu-latest GitHub Actions runners. On a standard Python codebase (a few thousand lines, a typical FastAPI or Django app), the scan completes well under 60 seconds (https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/using-jobs-in-a-workflow).
The fast path: Bandit, Semgrep, ast-grep, detect-secrets, and the six custom scanners (secret-pattern, privacy/PII, AI-pattern, performance, content-moderation, JavaScript-TypeScript) all run quickly. Most of the scan time is filesystem I/O and Python startup overhead, not scanner complexity.
What Affects Scan Time
BrassCoders’s slowest scanner is Pyre/Pysa, Meta’s interprocedural taint analyzer — it builds a type inference graph across the entire codebase before scanning, which takes seconds on small projects and minutes on large codebases with deep import trees.
Pyre/Pysa (https://pyre-check.org/docs/pysa-basics/) performs whole-project taint analysis. It traces data flows from untrusted sources (HTTP request parameters, environment variables) to security-sensitive sinks (database queries, subprocess calls). That analysis requires building a type graph, which scales with the number of files and the depth of your import tree.
Two variables dominate scan time:
- Project size: A 5,000-line project scans faster than a 50,000-line project.
- Pyre/Pysa warm-up: First run on a project is slower; subsequent runs benefit from incremental analysis.
If your project is large and scan time is a concern, .brassignore lets you exclude directories (test fixtures, generated code, vendored dependencies) from the scan. Excluding vendor/ or node_modules/ cuts both scan time and finding noise.
Install BrassCoders with pip install brasscoders and run brasscoders scan . from your project root. The OSS core is free and Apache 2.0 licensed. BrassCoders Paid adds semantic noise reduction for $12/dev/month.
Frequently Asked Questions
How long does brasscoders scan take on a large project?
It depends on project size and whether Pyre/Pysa taint analysis runs fully. A 5,000-line project typically scans in under 30 seconds. A 50,000-line project with deep import trees can take 2-5 minutes, primarily due to Pyre/Pysa's whole-project type inference. Use .brassignore to exclude vendored and generated code, which cuts time significantly.
Does brasscoders scan slow down CI?
On a typical Python codebase, BrassCoders runs in under 60 seconds — comparable to running your test suite's fast tier. It adds one parallel CI step, not sequential time. GitHub Actions lets you run it in parallel with tests.
Is the first scan slower than subsequent scans?
Yes — Pyre/Pysa builds a type graph on the first run, which takes longer than incremental analysis on subsequent runs. Subsequent scans on the same project are faster because Pyre/Pysa caches its type information between runs (when the cache is preserved across CI runs or local invocations).
Can I make brasscoders scan faster?
Use .brassignore to exclude directories that don't need scanning: vendor/, node_modules/, generated code directories, and test fixture directories with large files. Each excluded directory reduces both scan time and finding noise. Excluding a 10,000-file vendored dependency can cut scan time by 30-50% on projects that include them.