[Media] This is why you rewrite Python security tools in Rust: 53MB vs 433MB peak memory, 6.9s vs 62.2s

Github - https://github.com/ohaswin/pyscan

I have been working (on and off) for 3 years on this project. Here's the first post i made when it released 3 years ago.

Pyscan was engineered to solve the performance and memory bottlenecks of traditional Python-based security tools in production CI/CD pipelines:

• Devs get rid of slower tools in favor of getting CI/CD done faster, indirectly leaving them vulnerable
• Memory constraints do not justify adding a separate tool for security.

What it does: Pyscan automatically traverses your Python project, extracts dependencies across various packaging formats (uv, poetry, filt, pdm, requirements.txt, SBOMs, even source code), and cross-references them against the Open Source Vulnerabilities (OSV) database

One honest thing: Pyscan is on-par with uv audit , sometimes faster. If you use uv in your Python environment you actually don't need pyscan at all. Pretty cool since uv is Rust-based as well.

The recent release added:

• SBOM Native Support: Pyscan now natively parses CycloneDX (bom.json) and SPDX (spdx.json) files.
•  Reachability Heuristics: It scans your source code to find where you're actually importing the vulnerable packages and highlights them in the diagnostic output.

In the upcoming releases, I'll be improving QoL for CI/CD users and trying to see if i can make it faster than uv while also adding some interesting new features.

There's been an influx of AI slop in r/Python and I couldn't post it there, I hope it doesnt get removed here as well lol. Would love to hear feedback and answer any questions!