New Python vulnerability detector claims near-perfect accuracy with 100x speed advantage

Security researchers have introduced SAGA, a new technique for identifying vulnerabilities across Python source code with remarkable accuracy and performance. The method combines control- and data-flow analysis with a domain-specific language to detect a much broader range of threat patterns than existing tools.

How SAGA Works#

The approach leverages a source code parser that builds a symbolic representation of program control flow, capturing both the logical pathways through code and how data moves between operations. On top of this model, SAGA defines security-focused static aspects—reusable rules that describe properties related to integrity, confidentiality, and other protection concerns. As the analysis traverses this graph structure, these rules identify code patterns that could expose vulnerabilities.

Strong Performance Results#

Researchers tested SAGA against a curated collection of 108 security issues spanning 37 distinct vulnerability categories across 82 packages hosted on PyPI. The system achieved 100% sensitivity (catching all known flaws) and 99.15% specificity (limiting false alarms to just one), substantially outperforming four competing security analysis tools. Analysis of the entire test set completed in under 31 seconds—between 2.5 and 512 times faster than baseline competitors.

Addressing a Critical Gap#

Python's dominance in modern development has made security analysis of Python projects increasingly important, yet existing automated tools cover only a limited set of vulnerability types. SAGA's ability to detect across 37 categories represents a significant expansion of coverage, offering developers a more comprehensive way to scan for potential weaknesses before deployment.