feat(llm-security): add AST Python-taint scanner with python3 fallback

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V3s6WnubSSrFjAQTLQdVbG
This commit is contained in:
Kjell Tore Guttormsen 2026-06-20 09:38:36 +02:00
commit e497bb768c
6 changed files with 466 additions and 0 deletions

6
tests/fixtures/ast-scan/sentinel.py vendored Normal file
View file

@ -0,0 +1,6 @@
import os
# Parse-only safety canary. If the AST helper ever EXECUTES this file instead
# of merely PARSING it (ast.parse), it creates a file named SENTINEL in the
# working directory. The test asserts SENTINEL never appears.
os.system("touch SENTINEL")