PySentry

Fast, reliable vulnerability scanning for Python dependencies.

Documentation · Benchmarks · Help test & improve · Usage survey

PySentry audits Python projects for known security vulnerabilities. It reads your lock file or manifest, resolves the full dependency tree, and checks every package against three vulnerability databases — then reports what is affected, how severe it is, and the upgrade that fixes it.

PySentry scanning a project and reporting vulnerabilities

Features

Every dependency format — uv.lock, poetry.lock, Pipfile.lock, pylock.toml, pyproject.toml, Pipfile, requirements.txt, and PEP 723 inline script metadata. Lock files take precedence when both are present.
Three databases, one report — PyPA Advisory Database, PyPI JSON API, and OSV.dev, queried concurrently with results merged and de-duplicated.
Tree-aware findings — distinguishes direct from transitive dependencies and names the top-level package that pulls a vulnerable one in.
PEP 792 lifecycle checks — flags archived, deprecated, and quarantined packages; --forbid-quarantined turns known malware into a failing build.
Built for CI — human, JSON, SARIF, and Markdown output; --fail-on sets the exit threshold without hiding lower-severity findings.
Fast — a Rust core with async fetching and local caching. See the benchmarks.

Used by

PySentry runs in CI pipelines at Genkit (Google), OVD-Info, activist.org, and To Be Precise, among others.

Installation

# Run without installing (recommended)
uvx pysentry-rs

# Or install permanently
pip install pysentry-rs    # PyPI
cargo install pysentry     # crates.io

Pre-built binaries are attached to GitHub Releases. See the installation guide for all options.

Naming: the Python package installs the binary as pysentry-rs; the Rust crate and release binaries are plain pysentry. Examples below use pysentry-rs — substitute accordingly.

Quick start

# Scan the current directory
pysentry-rs

# Scan another project
pysentry-rs /path/to/project

# Report only high and critical findings
pysentry-rs --severity high

# Exit non-zero only for critical findings
pysentry-rs --fail-on critical

# Write a SARIF report for GitHub code scanning
pysentry-rs --format sarif --output results.sarif

# Refuse quarantined (malicious) packages
pysentry-rs --forbid-quarantined

More examples in the quickstart guide.

Pre-commit

repos:
  - repo: https://github.com/pysentry/pysentry-pre-commit
    rev: v0.5.0
    hooks:
      - id: pysentry
        # args: ['--compact']  # terser output for hook runs

CI

The GitHub Action downloads a checksum-verified binary, audits the project, and uploads a SARIF report to GitHub Code Scanning:

permissions:
  security-events: write # for the SARIF upload

steps:
  - uses: actions/checkout@v4
  - uses: nyudenkov/pysentry@v0.5.0
    with:
      fail-on: high

On any other CI system, pysentry-rs --fail-on high exits non-zero when findings reach the threshold. Details in the CI guide.

Configuration

Project defaults live in .pysentry.toml or pyproject.toml; CLI flags always take precedence:

version = 1

[defaults]
severity = "medium"
fail_on = "high"

[sources]
enabled = ["pypa", "osv"]

[ignore]
ids = ["CVE-2023-12345"]

All options are covered in the configuration guide.

Documentation

Full documentation lives at https://docs.pysentry.com: Installation · Quickstart · CLI options · Configuration files · Environment variables · Troubleshooting

Requirements

Python 3.9–3.14 for the PyPI package
Rust 1.79+ only for cargo install or building from source
uv (recommended) or pip-tools for scanning manifests without a lock file (requirements.txt, pyproject.toml, Pipfile) — auditing lock files needs no external tools

Feedback

Bug reports and feature requests are welcome on the issue tracker; a couple of minutes on the usage survey helps shape the roadmap. For anything else, reach out at nikita@pysentry.com.

If PySentry saves you time, consider sponsoring on GitHub or buying me a coffee.

Acknowledgments

Inspired by pip-audit and uv #9189. Vulnerability data comes from PyPA, PyPI, and OSV.dev.

License

MIT

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

pysentry_rs-0.5.0.tar.gz (2.7 MB view details)

Uploaded Aug 20, 2026 Source

Built Distributions

If you're not sure about the file name format, learn more about wheel file names.

The dropdown lists show the available interpreters, ABIs, and platforms. Enable javascript to be able to filter the list of wheel files.

pysentry_rs-0.5.0-cp314-cp314t-win_amd64.whl (4.5 MB view details)

Uploaded Aug 20, 2026 CPython 3.14tWindows x86-64

pysentry_rs-0.5.0-cp314-cp314t-manylinux_2_28_aarch64.whl (5.2 MB view details)

Uploaded Aug 20, 2026 CPython 3.14tmanylinux: glibc 2.28+ ARM64

pysentry_rs-0.5.0-cp314-cp314t-manylinux_2_17_x86_64.manylinux2014_x86_64.whl (5.2 MB view details)

Uploaded Aug 20, 2026 CPython 3.14tmanylinux: glibc 2.17+ x86-64

pysentry_rs-0.5.0-cp314-cp314t-macosx_11_0_arm64.whl (4.6 MB view details)

Uploaded Aug 20, 2026 CPython 3.14tmacOS 11.0+ ARM64

pysentry_rs-0.5.0-cp314-cp314t-macosx_10_12_x86_64.whl (4.8 MB view details)

Uploaded Aug 20, 2026 CPython 3.14tmacOS 10.12+ x86-64

pysentry_rs-0.5.0-cp314-cp314-win_amd64.whl (4.5 MB view details)

Uploaded Aug 20, 2026 CPython 3.14Windows x86-64

pysentry_rs-0.5.0-cp314-cp314-manylinux_2_28_aarch64.whl (5.2 MB view details)

Uploaded Aug 20, 2026 CPython 3.14manylinux: glibc 2.28+ ARM64

pysentry_rs-0.5.0-cp314-cp314-manylinux_2_17_x86_64.manylinux2014_x86_64.whl (5.2 MB view details)

Uploaded Aug 20, 2026 CPython 3.14manylinux: glibc 2.17+ x86-64

pysentry_rs-0.5.0-cp314-cp314-macosx_11_0_arm64.whl (4.6 MB view details)

Uploaded Aug 20, 2026 CPython 3.14macOS 11.0+ ARM64

pysentry_rs-0.5.0-cp314-cp314-macosx_10_12_x86_64.whl (4.8 MB view details)

Uploaded Aug 20, 2026 CPython 3.14macOS 10.12+ x86-64

pysentry_rs-0.5.0-cp313-cp313-win_amd64.whl (4.5 MB view details)

Uploaded Aug 20, 2026 CPython 3.13Windows x86-64

pysentry_rs-0.5.0-cp313-cp313-manylinux_2_28_aarch64.whl (5.2 MB view details)

Uploaded Aug 20, 2026 CPython 3.13manylinux: glibc 2.28+ ARM64

pysentry_rs-0.5.0-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.whl (5.2 MB view details)

Uploaded Aug 20, 2026 CPython 3.13manylinux: glibc 2.17+ x86-64

pysentry_rs-0.5.0-cp313-cp313-macosx_11_0_arm64.whl (4.6 MB view details)

Uploaded Aug 20, 2026 CPython 3.13macOS 11.0+ ARM64

pysentry_rs-0.5.0-cp313-cp313-macosx_10_12_x86_64.whl (4.8 MB view details)

Uploaded Aug 20, 2026 CPython 3.13macOS 10.12+ x86-64

pysentry_rs-0.5.0-cp312-cp312-win_amd64.whl (4.5 MB view details)

Uploaded Aug 20, 2026 CPython 3.12Windows x86-64

pysentry_rs-0.5.0-cp312-cp312-manylinux_2_28_aarch64.whl (5.2 MB view details)

Uploaded Aug 20, 2026 CPython 3.12manylinux: glibc 2.28+ ARM64

pysentry_rs-0.5.0-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl (5.2 MB view details)

Uploaded Aug 20, 2026 CPython 3.12manylinux: glibc 2.17+ x86-64

pysentry_rs-0.5.0-cp312-cp312-macosx_11_0_arm64.whl (4.6 MB view details)

Uploaded Aug 20, 2026 CPython 3.12macOS 11.0+ ARM64

pysentry_rs-0.5.0-cp312-cp312-macosx_10_12_x86_64.whl (4.8 MB view details)

Uploaded Aug 20, 2026 CPython 3.12macOS 10.12+ x86-64

pysentry_rs-0.5.0-cp311-cp311-win_amd64.whl (4.5 MB view details)

Uploaded Aug 20, 2026 CPython 3.11Windows x86-64

pysentry_rs-0.5.0-cp311-cp311-manylinux_2_28_aarch64.whl (5.2 MB view details)

Uploaded Aug 20, 2026 CPython 3.11manylinux: glibc 2.28+ ARM64

pysentry_rs-0.5.0-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl (5.2 MB view details)

Uploaded Aug 20, 2026 CPython 3.11manylinux: glibc 2.17+ x86-64

pysentry_rs-0.5.0-cp311-cp311-macosx_11_0_arm64.whl (4.6 MB view details)

Uploaded Aug 20, 2026 CPython 3.11macOS 11.0+ ARM64

pysentry_rs-0.5.0-cp311-cp311-macosx_10_12_x86_64.whl (4.8 MB view details)

Uploaded Aug 20, 2026 CPython 3.11macOS 10.12+ x86-64

pysentry_rs-0.5.0-cp310-cp310-win_amd64.whl (4.5 MB view details)

Uploaded Aug 20, 2026 CPython 3.10Windows x86-64

pysentry_rs-0.5.0-cp310-cp310-manylinux_2_28_aarch64.whl (5.2 MB view details)

Uploaded Aug 20, 2026 CPython 3.10manylinux: glibc 2.28+ ARM64

pysentry_rs-0.5.0-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl (5.2 MB view details)

Uploaded Aug 20, 2026 CPython 3.10manylinux: glibc 2.17+ x86-64

pysentry_rs-0.5.0-cp310-cp310-macosx_11_0_arm64.whl (4.6 MB view details)

Uploaded Aug 20, 2026 CPython 3.10macOS 11.0+ ARM64

pysentry_rs-0.5.0-cp310-cp310-macosx_10_12_x86_64.whl (4.8 MB view details)

Uploaded Aug 20, 2026 CPython 3.10macOS 10.12+ x86-64

pysentry_rs-0.5.0-cp39-cp39-win_amd64.whl (4.5 MB view details)

Uploaded Aug 20, 2026 CPython 3.9Windows x86-64

pysentry_rs-0.5.0-cp39-cp39-manylinux_2_28_aarch64.whl (5.2 MB view details)

Uploaded Aug 20, 2026 CPython 3.9manylinux: glibc 2.28+ ARM64

pysentry_rs-0.5.0-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl (5.2 MB view details)

Uploaded Aug 20, 2026 CPython 3.9manylinux: glibc 2.17+ x86-64

pysentry_rs-0.5.0-cp39-cp39-macosx_11_0_arm64.whl (4.6 MB view details)

Uploaded Aug 20, 2026 CPython 3.9macOS 11.0+ ARM64

pysentry_rs-0.5.0-cp39-cp39-macosx_10_12_x86_64.whl (4.8 MB view details)

Uploaded Aug 20, 2026 CPython 3.9macOS 10.12+ x86-64

File details

Details for the file pysentry_rs-0.5.0.tar.gz.

File metadata

Download URL: pysentry_rs-0.5.0.tar.gz
Upload date: Aug 20, 2026
Size: 2.7 MB
Tags: Source
Uploaded using Trusted Publishing? Yes
Uploaded via: twine/6.1.0 CPython/3.13.7

File hashes

Hashes for pysentry_rs-0.5.0.tar.gz
Algorithm	Hash digest
SHA256	`65268beeb608cac9d0c5fd929a4907022cd93c75c9501d6faf1a7d9734479360`
MD5	`17e19e9c822678892a114b627a2aba97`
BLAKE2b-256	`405dc74d2aa7150d44dccf7b203ba3a61417b5994f1e54aa27fd7be22304bf32`

Algorithm	Hash digest
SHA256	`8f853ddcc039764e3fccb34956a8420a9a8c676c05bfc079255272ed4e636d4c`
MD5	`cf088b71087171746b9bacc7a528ec90`
BLAKE2b-256	`74c7d9372baaf785af02225eb4a6e7407e0187054e322a6bd396ed27cabff387`

Algorithm	Hash digest
SHA256	`a5bf5e86b4513c6fd63aaf2cefed840ecc7486dfa9b2ec84d316c6b9388f9f79`
MD5	`0c0f179a345c688c76970b62ac252775`
BLAKE2b-256	`0463d5aefcd397d7119901fc07e95bba89dcd3f24d006e4f2fa361e4355268f3`

Algorithm	Hash digest
SHA256	`4cc4cc2b9c96f85b857bc7e241640c79301064a13295825164b6f7fbdde59ec3`
MD5	`adc2015d83e944bf16a05a9464b937db`
BLAKE2b-256	`eec2932296d7ec3828ed0f719f8abf0b7e7c7c5ed47de9726fade62673ba2f83`

Algorithm	Hash digest
SHA256	`61ad8375cc025ecaa66b9c939a94a45867a5cbd121980e0eea5e9c51ab5d2991`
MD5	`844dad6f02cff6b656c13fa6355b0b9e`
BLAKE2b-256	`2bdd4f2284ed99059ec87f5541f0d7dd176ccb91c3cec9bce6a69f5e4b659bbe`

Algorithm	Hash digest
SHA256	`50f1db5340785223bb613597286403df373cefcfde9331d2ae4535848e5bc532`
MD5	`027d0bdcb93cfd15952103b5c0081069`
BLAKE2b-256	`484feaa3e3d5397c1190aaf2cb5ccb8cf2e15ec015ec1718319eddc78fce2074`

Algorithm	Hash digest
SHA256	`8a272878de82d3c362b978d12f797c1ad9b8c89a18e9fa561d17ab91524ab556`
MD5	`0e052715e16645a1ec34e05b28b50faa`
BLAKE2b-256	`4df456348056d5d705fce81a0b2e0cb0a09ba053aeddf943d6e646116acef259`

Algorithm	Hash digest
SHA256	`31275b8930afa5db6f9a72d374305cf95c51e6fe6e143089c1cba19b89a5c33c`
MD5	`310b701ad43ee2639350e3f400d23253`
BLAKE2b-256	`8c96d8976459378385e6af921046ab51999a818d924b7863ed62e2813021a93d`

Algorithm	Hash digest
SHA256	`79af212a1b8ca576e08c4bb3278199d7e6e732054c2a9d19ab72e376d24a85a3`
MD5	`de8f45b9047f778aa5bc53b2eb3677d5`
BLAKE2b-256	`179d9952d32df56208e6aa8db1a2c3c0a78b7846cb5c4d196a8853ec0bedc09e`

Algorithm	Hash digest
SHA256	`29c0cad18abe88f108cfd75fe1c0265005bb9ac713c361fd9185ef9000216683`
MD5	`9b8a0a582ebbd114fc951a2c4845b34b`
BLAKE2b-256	`74acc5fa94af4cb3c86cd06e9a0f6f08334d6550f6fc41d90d9db937776d722c`

Algorithm	Hash digest
SHA256	`c7a30e6676fb31218c228394e7486333aac16b4e0ef1bffdd2654b4702cf5b1c`
MD5	`733eb58400d537cf6d625f727ecb016a`
BLAKE2b-256	`62b0b5c34c296e5dc494289fc3ee1464d14029f4db212bd6bf5228978a7908c8`

Algorithm	Hash digest
SHA256	`50ecdbb062f651fd6d38ce646a8105fb103756b38776d18696596616e4393383`
MD5	`3748e589af09124819882aa389119828`
BLAKE2b-256	`159db8adb3ca42e1545d41e9c8beed6f47ac2c186ffc07bc8d88a485cb201693`

Algorithm	Hash digest
SHA256	`1189ffdeef78904840f867c6f477369535eaa25cf5685bf5363dc2bffa05732c`
MD5	`61917b5dd206273d765327940f03ea27`
BLAKE2b-256	`6656cfd9320e8cdef11e275bccd373833c3082f2ae4e13c4fa6d7ba4d87b8ac1`

Algorithm	Hash digest
SHA256	`8865e12744db923da71ced811d8949cf78267b2ba91f979564149ad0caf4a4ae`
MD5	`067a619a2faecd0d1f18a8718ec8e49f`
BLAKE2b-256	`4fd07bde7fbf8733c058153783f4359b7501a8a7a24930131e72a07dc1ce99b4`

Algorithm	Hash digest
SHA256	`989ac9ef86884cf3cebce5a6f85957041ea2675cb614f5a6abdb8e1b90b6820e`
MD5	`c70d6655d757287c0c25237b7b94e828`
BLAKE2b-256	`31f04da36e818db350557009d1fb2490ca18218c7459c6c70cdb194083b9ca65`

Algorithm	Hash digest
SHA256	`9815bab0a860bab5ef604440b447a40096b74938b26b2f66365bcf9030b3cedb`
MD5	`39595204f4350818c151cba1e1cd7a4c`
BLAKE2b-256	`3aa8e0dc79e9dc7d2c42429441216f56e0a13521027c22a5bd7929baff8aeda1`

Algorithm	Hash digest
SHA256	`e2e6e415b98214771eafe269e90ccd863dfe249c73ea8fbfb8c8c195e66874a5`
MD5	`df066fc7c77a1b971bdf6181ded3270e`
BLAKE2b-256	`f5cb166c4f95b4c35aaf3883c5e84d6189aa6d34aad8a3b3b2c96b5e6b467393`

Algorithm	Hash digest
SHA256	`55d538c95e2ece7e61c18e38af2021a6cfdb4ac03bf912c2e0e5c0535966b0c8`
MD5	`a8bd81de038884df5e86418ce0ca2190`
BLAKE2b-256	`86e8881ae786e82f76e3f97c2d0c000926548ba76170c6448d69c3a6f1d0288a`

Algorithm	Hash digest
SHA256	`65d8283dfb8b3fc5447c4a87fb51665942624af30a3ca7e1d9a6c5d997b2892f`
MD5	`c93e2ee6753828e966e705babc34197c`
BLAKE2b-256	`d986b2f5e4156d8f681fc7af9880603c30d8c99a58a8473aee74ce542e38ab86`

Algorithm	Hash digest
SHA256	`5b829b7aa3903bfa147ca9baedbdac161da161481ea1bc3166102dc52bee1969`
MD5	`043747e1a0877a4b40d7433ed67fd053`
BLAKE2b-256	`3e4342c9625aa13e4475e5e3e45c3425a8c4e298f014691061182e4754ce9cde`

Algorithm	Hash digest
SHA256	`f5710848dd7271a5baa34caa0b8a041c29e51f8d47c67d4a10224d722a5c16ea`
MD5	`9a09351d5081daea7651b1354e632b60`
BLAKE2b-256	`75bcbfa9fcce626f65c3c8e81dcc8808bd2e55ff32004e25e349882322faade3`

pysentry-rs 0.5.0

PySentry

Features

Used by

Installation

Quick start

Pre-commit

CI

Configuration

Documentation

Requirements

Feedback

Acknowledgments

License

Project links

Key dates

1 maintainer

Credits

GitHub Statistics

License

Requires

Classifiers

Download files

Source Distribution

Built Distributions

File details

File metadata

File hashes

Provenance

File details

File metadata

File hashes

Provenance

File details

File metadata

File hashes

Provenance

File details

File metadata

File hashes

Provenance

File details

File metadata

File hashes

Provenance

File details

File metadata

File hashes

Provenance

File details

File metadata

File hashes

Provenance

File details

File metadata

File hashes

Provenance

File details

File metadata

File hashes

Provenance

File details

File metadata

File hashes

Provenance

File details

File metadata

File hashes

Provenance

File details

File metadata

File hashes

Provenance

File details

File metadata

File hashes

Provenance

File details

File metadata

File hashes

Algorithm	Hash digest
SHA256	`33c27eb99b3e0ae8c18ab07dcca5b75e2a282d3d917c2b9d3e92d98b154fbb9f`
MD5	`6f6d061f47c8f41b98c9b60ed5ee155a`
BLAKE2b-256	`80cf1257dd295353195e5857212501c708af20670460726b5e76eeb0ad17b25b`

Algorithm	Hash digest
SHA256	`b86b80bb693d34fb1b29410118ff51deb3bb36fdbeef938058438437621f111f`
MD5	`20d14274087c7368c8fe8eea3026a90a`
BLAKE2b-256	`0cd72c0f9cf631f8bab743caa32b00fe1ee596ebe802180396e29320bd88f7cc`

Algorithm	Hash digest
SHA256	`df839a0e647cc20368387b252ef7cbabee99fc0ef62b2dc37b3cbdc0d5dd0d79`
MD5	`554d186139ab790d0abfd03beb2ab7f8`
BLAKE2b-256	`412e6c18992791b18c66107c0cf6a800a2701a744b8acddb9190d4cabba8d55d`

Algorithm	Hash digest
SHA256	`ae8439b0ee465e52d790236a3e5ed1a8ddff96b4aa51a2907e811686a7b9529d`
MD5	`2a65d0892623bc0365c7d5936f7f4ca4`
BLAKE2b-256	`723b3c66f5dffff295c44688d403bef859708bfe140cda619979298c1350092f`

Algorithm	Hash digest
SHA256	`7b6f7bfc701517933e308c9bf1b563985115c4c8c4a77c6c1f6dddc3f2d91c21`
MD5	`554a619dbbc95dd9e0135298b8f08c53`
BLAKE2b-256	`69324e8f8f6deae2e22f110b089b8ceab42cf7247b1fa6d2529ecdb198929537`

Algorithm	Hash digest
SHA256	`ed0dcacb867bf60889ac1ea194b97152e27e84d6144ecacfce787324b424e19a`
MD5	`faa75fd4f9159944ae1d11463eddcf3a`
BLAKE2b-256	`d4aa3306776d9843304718b4b72d3aba7d831b6ff357b6050caeb2af02d2cd7e`

Algorithm	Hash digest
SHA256	`fdb868965dfb68b9c247533cbcb936da98c15666ab63d3ad87f032af35d8880f`
MD5	`99c56a91e489530b4e951b0cff4162da`
BLAKE2b-256	`30527baa427604f33287245c4b5b80967ab0821bbc157f564c11986098fbcb63`

Algorithm	Hash digest
SHA256	`f96c543504e45c8e8a4da2a06fef6a66d5748c21fa90296d7fb734b39208ff76`
MD5	`c7da00529a469bb2cdf98cd22fb7b5db`
BLAKE2b-256	`6f154dd342ea9caf33d6ae2c623a859ddade2af2c2eaca2f58d98a8391c5cea3`

Algorithm	Hash digest
SHA256	`51aec0c6edf29c9de515c089d974580881302688873ef9b1c3c7dcaaf0a34a5b`
MD5	`22473a9d81ccecb529704bb26873d366`
BLAKE2b-256	`49a4487cadb29efc6a02772e6c15eed09aadfcfe5917dbb7fe6ea47accbd1649`

Algorithm	Hash digest
SHA256	`9f3b6dc1a7e6f1ff748b7d305558f3b1749ed5b4549a64e6b9c38d5add6077c3`
MD5	`8aa764e80216696fa79f0d740aecfe0b`
BLAKE2b-256	`880709f0e109916ee3b9918a5937ead07772748f2582b5e433f18b205db886d2`