PIP-AUDIT TRIAGE · RUNS IN YOUR BROWSER

Which pip-audit findings does your code actually import?

pip-audit prints a flat list of vulnerable packages with no severity and no way to tell the one your service imports from the one a linter dragged in. Paste the pip-audit -f json output and your Python source: findings are ranked by whether the vulnerable package is imported by your runtime code, test/tooling only, or not referenced. Paid platforms (Snyk, Endor Labs) sell reachability analysis; this is the free, offline first pass.

Nothing is uploaded. What you paste is read in this browser and never leaves your device, and this tool makes no network calls of its own. It is a static text scan and a heuristic ranking, not a security audit.

1. Paste pip-audit -f json

2. Paste your source (optional but it is the point)

Concatenate files, or put a line # file: app/main.py before each so test files are recognised. In the CLI the directory is scanned for you.

Paste the audit output above and click Triage.

Want it as a CI gate?

Same logic, zero dependencies. It reads the audit file and walks your source directory, nothing else:

pip-audit -f json | node pip-audit-triage.mjs - src          # triage, print ranked list
pip-audit -f json | node pip-audit-triage.mjs - src --fail-on-imported   # exit 1 if a runtime-imported package is vulnerable
node pip-audit-triage.mjs audit.json src lib --json         # machine-readable

Get pip-audit-triage.mjs and triage.mjs from the repo. Run pip-audit yourself first; this tool only reads its output. Node 18+, nothing to install, no network calls.

Common questions

Why does pip-audit report vulnerabilities in packages I barely use?

pip-audit matches every installed or pinned distribution against an advisory database such as PyPI and OSV. It does not look at your code, so it cannot tell a package your service imports on every request from a transitive dependency of a linter. pip-audit also reports no severity, so a long list has no obvious order. This tool adds one signal, whether your Python source imports the package, so you read the reachable findings first.

How does the triage decide a package is reachable?

It scans .py source as text for import, from-import, importlib.import_module and __import__ statements, maps each distribution name to the module name it installs (PyYAML is imported as yaml, Pillow as PIL, scikit-learn as sklearn) and compares them to the audit. A vulnerable package imported from runtime code ranks first, one imported only from tests, docs or tooling ranks next, and one never referenced ranks last. It is a static text scan and cannot see imports built from variables.

Does this mean the low-ranked vulnerabilities are safe to ignore?

No. Not imported is not the same as not exploitable: a package can be loaded by a plugin entry point, a framework that imports by string, or another package you do import, and it can be a transitive dependency of something you do use. The ranking tells you where to look first, not what to skip forever. Keep patching on a schedule.

Does this tool upload my audit output or source code?

No. Everything you paste is processed in this page and never leaves your device, and the page makes no network calls. The CLI reads the audit file and the source directory you name and nothing else.

Is this security advice?

No. It is a heuristic ranking of publicly reported advisories using a text scan of your code. It is not a security audit, penetration test or guarantee, and it can miss reachable vulnerabilities.

More: how to triage pip-audit findings without ignoring real risk