Code is queryable.

Write a question as a rule. Get a precise answer in seconds.

Python SDK reference → codepathfinder.dev/sdk

@python_rule(id="PYTHON-FLASK-SEC-001", severity="CRITICAL")
def flask_sqli():
  return flows(
    from_sources=[FlaskRequest.method("args.get")],
    to_sinks=[DBCursor.method("execute").tracks(0)],
    sanitized_by=[calls("escape")],
    scope="global",
  )

[CRIT] PYTHON-FLASK-SEC-001
       cross-file taint  ·  0.9s

  app/views.py:12   request.args.get("name")
  helpers.py:8      lookup_user(name)
  helpers.py:14     fetch_user(name)
  db.py:6           cursor.execute(query)

# 1 finding · 3 files · global taint

211 rules live in the registry today. Bring your own — or run ours on every PR.

You can't build CI on a coin flip.

Ask Claude or Cursor to trace a multi-hop call chain. Sometimes it nails it. Sometimes it misses a one-liner. Same prompt, different runs, different answers. Fine for exploration — not OK for a security gate.

# Run 1 — "who calls validate_user?"
12 callers, all real:
  ✓ app/api.py:82  login_endpoint
  ✓ app/api.py:145 register_endpoint
  ... 10 more, nails it

# Run 2 — same prompt, 5 min later
10 callers:
  ✓ app/api.py:82
  ✗ app/api.py:145 # missed
  ... 8 more, 2 silently dropped

# pathfinder.get_callers("validate_user")
12 callers, exact file:line
  ✓ app/api.py:82  login_endpoint
  ✓ app/api.py:145 register_endpoint
  ✓ app/middleware.py:34
  ✓ app/cli.py:18  login_command
  ... 8 more, identical every run

One engine. Two ways to find bugs.

It finds real bugs in real code.

Three ways in.

The same engine. The Langflow rule you just saw runs on your code in any of these.