[Biopython] Enroll Biopython in the Anthropic project to scan critical open-source repositories for security vulnerabilities?

[Andrew Dalke]

On Oct 20, 2026, at 11:46, Dan Bolser <dan.bolser at gmail.com> wrote:
> 
> Should Biopython enroll in the Anthropic project to scan critical open-source repositories for security vulnerabilities?
> 
> Looks like a good idea to me:
> https://github.com/anthropics/oss-scanner
> 
> Thoughts?

The questions are:

 - who will do this work?
 - who will define the security and trust models? [1]
 - will the response be only code changes or will it include regression tests?
 - how much effort should be spent on this?
 - what other scanning tools should also be considered?

([1] A user-defined regex implemented as an NFA can result in exponential run-time. If an untrusted source can specify the regex, this can lead to DoS attacks, eg, on a public web server. If a trusted source specifies the same regex on a command-line application, that's almost certainly not a security issue.)

As an observation, code analysis tools have been around for decades. The easiest ones to use are the ones built into gcc/clang, which can be enabled with a few flags.

I built Biopython just now with

  env CC="gcc-14 -Wall -Wextra" pip install -e . -v

It reports (among a bunch of other warnings which could likely be ignored, but which could all be addressed):

  In file included from /usr/local/opt/python at 3.10/Frameworks/Python.framework/Versions/3.10/include/python3.10/Python.h:74:
  In function '_Py_XDECREF',
      inlined from 'Aligner_align' at Bio/Align/_codonaligner.c:1046:25:
  /usr/local/opt/python at 3.10/Frameworks/Python.framework/Versions/3.10/include/python3.10/object.h:566:8: warning: 'paths' may be used uninitialized [-Wmaybe-uninitialized]
    566 |     if (op != NULL) {
        |        ^
  Bio/Align/_codonaligner.c: In function 'Aligner_align':
  Bio/Align/_codonaligner.c:900:20: note: 'paths' was declared here
    900 |     PathGenerator* paths;
        |                    ^~~~~


The problem occurs in Aligner_align because

    PyObject* result = NULL;
    ...
    PathGenerator* paths;
     ...
    if (nB < 3) {
        PyErr_Format(PyExc_ValueError,
                     "at least 3 nucleotides are needed for a codon alignment; "
                     "%zd received", nB);
        goto exit;
    }
    ...
    paths = (PathGenerator*)PyType_GenericAlloc(&PathGenerator_Type, 0);
    ...
    result = Py_BuildValue("fN", score, paths);

exit:
    ...
    if (result == NULL) Py_XDECREF(paths);

If that ValueError occurs then result will be NULL causing Py_XDECREF of an uninitialized variable.

That appears to be the only uninitialized use detected by gcc, but gcc isn't the only option. There are many static analysis tools, code sanitizers to detect run-time errors, fuzz testing, and more, all with a proven track record of identifying security vulnerabilities.

My observation is that if people aren't already using these tools (and putting in the effort to handle the false positives they invariably present), then I suspect there's isn't much general interest in using a proprietary service like what Anthropic offers.


Cheers,
					Andrew
					dalke at dalkescientific.com