[Biopython] Enroll Biopython in the Anthropic project to scan critical open-source repositories for security vulnerabilities?

[Peter Cock]

On Wed, Oct 21, 2026 at 9:25 AM Andrew Dalke <dalke at dalkescientific.com> wrote:
>
> On Oct 20, 2026, at 11:46, Dan Bolser <dan.bolser at gmail.com> wrote:
> >
> > Should Biopython enroll in the Anthropic project to scan critical open-source
> > repositories for security vulnerabilities?
> > ...
>
> ...That appears to be the only uninitialized use detected by gcc, but gcc isn't the
> only option. There are many static analysis tools, code sanitizers to detect
> run-time errors, fuzz testing, and more, all with a proven track record of identifying
> security vulnerabilities.
>
> My observation is that if people aren't already using these tools (and putting in the
> effort to handle the false positives they invariably present), then I suspect there's
> isn't much general interest in using a proprietary service like what Anthropic offers.

I/we have been making efforts over time on the Python side with linting tools,
including type-checking - and again there are plenty of false positives to sift
through but the occasional meaningful fix on top of sylistic improvements.

And we should probably log that Bio/Align/_codonaligner.c issue.

Peter