Bandit flagged 47. Three are real.
A deterministic gate that deletes your scanner's false positives and keeps the actual vulnerabilities. 8 CWE classes, in your browser, nothing leaves the page, and every run emits a reproducible receipt hash.
The 8 classes it keeps
Everything else (style, complexity, unused imports) is out of scope and gets dropped. This list is generated from the gate's source; examples are lifted from its test fixtures.
| CWE | what it catches | trigger (from fixtures) |
|---|---|---|
| CWE-95 | code execution: eval / exec | eval(user_input) |
| CWE-502 | unsafe deserialization: pickle / yaml.load | pickle.loads(payload) |
| CWE-89 | SQL built from a dynamic string | cur.execute(f'SELECT * FROM u WHERE id={uid}') |
| CWE-78 | shell injection: shell=True / os.system | subprocess.run(cmd, shell=True) |
| CWE-295 | TLS verification disabled | requests.get(url, verify=False) |
| CWE-489 | Flask debug server in production | app.run(debug=True) |
| CWE-327 | weak hash over a credential | hashlib.md5(password.encode()) |
| CWE-798 | hardcoded credential | API_KEY = 'sk-live-abcdef123456' |
Run it in CI
The same gate, chained after Bandit, it strips Bandit's false positives (measured 89.67% removed on 20,147 real files, /kruc H5) at a 4.14% false-kill rate (H4). Air-gap capable: vendored, zero network calls, zero LLM cost.
pre-commit
repos:
- repo: local
hooks:
- id: kruc-gate
name: KRUC deterministic security gate
entry: python3 kruc-gate/kruc_gate.py
language: system
types: [python]
github action
- uses: blacktrace/kruc-gate@v1
with:
path: "." # blocks the PR only on the 8 real CWE classes
pre-commit hook + GitHub Action + updates · cancel anytime · Stripe invoice
Get the CI gate →After checkout you land on an install page that hands over the three hook files and the one-line config above. The hook runs entirely on your machine.
FAQ
Does my code leave the browser?
No. The gate is compiled to WebAssembly and runs locally; the page's CSP is scoped to this route with no external calls. Load the page, go offline, it still runs.
Why deterministic instead of an LLM triaging findings?
Same input always yields the same verdict and the same receipt hash: auditable, reproducible, free at runtime. An LLM is none of those.
What does PASS mean?
Out of the gate's 8 encoded classes, not "safe." It is a focused checker, not a full scanner.
Which scanners does it filter?
Bandit today. Others will be named here only when they're real.
Refunds and cancellation?
Monthly, cancel anytime from the Stripe invoice. Email x@blacktrace.co.