getdebug 0.4.0 adds Python AI-app security patterns, outperforms generic SAST tools

getdebug, a CLI tool for scanning AI-app codebases, released version 0.4.0 with Python support for five deterministic, regex-based anti-pattern detectors: prompt-injection, unsafe-role-merge, pii-in-prompt, unbounded-stream, and unsafe-tool-output. These patterns join the JS/TS detectors shipped in 0.3.0. The tool runs in milliseconds, costs zero, and requires no LLM call—just static pattern matching against SDK idioms like subprocess.run(tool_call.input.command, shell=True) or stream=True without timeout guards.

The team benchmarked getdebug against three competitors: Bandit (the Python-OSS security linter standard, hand-written rules, Python-only), Semgrep (multi-language SAST with community rule packs, hand-written rules), and vulnhuntr (Protect AI's open-source LLM-app static analyzer, LLM-driven, Python-only, entry-point-detection-based). In a synthetic test on ten paired vulnerable/safe Python fixtures (one pair per anti-pattern category), getdebug achieved 83% precision and 100% recall (5 true positives, 1 false positive, 0 false negatives). Bandit and Semgrep both scored 50% precision and 20% recall (1 TP, 1 FP, 4 FN each), because they flagged the safe variant of the unsafe-tool-output fixture—one where subprocess.run(shell=True) received a value from a static allowlist, not model output. Neither tool understood that cmd came from a static dict; getdebug's regex requirement that tool_call.input.X appear in the sink argument filtered out that false positive. Both tools also missed the other four behavioural categories entirely; their rule packs contain no patterns for prompt-injection, pii-in-prompt, unsafe-role-merge, or unbounded-stream.

The real-world test ran all three working tools on simonw/llm (Simon Willison's CLI for talking to LLMs, 49 Python files, commit 0d593ea). Bandit returned 1,261 findings—1,228 of them flagged assert_used on pytest assertions, a long-standing complaint about Bandit's default config. The remaining signal was zero AI-app coverage. Semgrep found 3 generic-SAST hits (an exec() in cli.py for the plugin system, a missing-integrity attribute on a static HTML asset, a non-literal import)—again, zero AI-app specific. getdebug surfaced 7 findings: 6 AI-app categorized (1 prompt-injection from template-feature concatenation, 5 unbounded-stream hits in the OpenAI plugin with stream=True and no timeout in scope) and 1 borderline role-merge (the role echoing the API's own response, not request input). All were flagged HIGH / MEDIUM (not CRITICAL) with context to triage. vulnhuntr installed cleanly on Python 3.11 but selected zero files because its entry-point heuristic targets network-exposed web apps, not CLI tools.

The team acknowledged the earlier version (0.4.0) showed a clean sweep on the synthetic fixture, but an updated detector added in 0.5.5 (scanPyShellToolArg) now flags that safe allowlist case as CRITICAL because it sees tool_call.input.tag reaching shell=True without understanding the static routing. This regression is tracked for tightening. The authors recommend running all three tool categories complementarily: Bandit for Python hygiene (with assert_used disabled), Semgrep for cross-language SAST, and getdebug for AI-app behavioural patterns. The benchmark corpus, methodology, and harness are open on GitHub under CodeSecBench, and the tool can be installed via npm (@getdebug/cli@0.4.0) or Homebrew (getdebug-ai/tap/getdebug).

getdebug is addressing a genuine blind spot in the open-source security-linting landscape. Bandit and Semgrep are mature, widely-used tools designed for general Python security and cross-language SAST respectively; they excel at catching SQL injection, unsafe deserialization, and missing integrity checks. But neither was built to understand LLM-specific risks—serializing user objects into prompts, streaming without timeouts, merging incompatible role fields in message arrays. The benchmark reveals the cost of that generality: Bandit's 1,228 assert_used warnings on a 49-file codebase are noise for most production environments, and Semgrep's three findings are real but generic, not AI-app specific.

vulnhuntr, positioned as the category leader for LLM-driven AI-app analysis, takes a different approach by invoking an LLM to infer entry points and vulnerabilities. The tradeoff is scope: it selects files based on web-app heuristics, leaving CLI tools unanalyzed. getdebug's regex-based layer sidesteps that by running on any Python that touches an LLM SDK, whether web or command-line. The trade-off in the other direction is that hand-written regex patterns can miss novel attack surfaces that an LLM might infer; the tool's designers acknowledge this and invite open community feedback.

The public benchmark methodology and open-source corpus (CodeSecBench on GitHub) set a high bar for transparency. In the real-world test on simonw/llm, getdebug's seven findings included two that depend on threat model (prompt-injection between two CLI-user inputs in a single-user tool) and role-merge logic routed through API responses rather than request input. The tool surfaces everything flagged, lets teams triage via .getdebug-ignore files, and acknowledges the borderline cases—a stance that trades off noise reduction for completeness.

No comments yet. Be the first to share your thoughts!