Dogfooding, not marketing copy

We pointed Aletheore at real code. Here's exactly what came back.

No cherry-picking, no staged examples: the full output of one command, run today against the current default branch of two well-known open source projects. Every number below is independently verifiable — clone the same repo, run the same command, get the same answer.

What we ran 
pipx install aletheore
git clone https://github.com/pallets/flask.git
aletheore scan flask

Flask · Python

5,545 commits. 83 files. 18.3k lines.

Scan finished in about 11 seconds — most of that is 6 real network round-trips (one per pinned dependency) to OSV.dev and the PyPI license registry, not local parsing. Skip both with --no-check-vulnerabilities --no-check-licenses and the same scan drops under 4 seconds.

17 advisories, on 3 dependencies, with exact installed versions

From a single OSV.dev lookup per pinned package — no LLM guessing.

PackageInstalledAdvisories
jinja2 3.1.2 10 — sandbox breakout via attr/format method, HTML attribute injection via xmlattr
werkzeug 3.1.0 6 — safe_join() Windows device-name handling
click 8.1.3 1 — command injection in click.edit()

Worth being precise here rather than impressive: OSV.dev cross-lists the same underlying vulnerability under multiple advisory identifiers (a GHSA and a PYSEC ID, sometimes more), so those 17 raw entries are really 8 distinct issues when grouped by identical advisory text — compare GHSA-cpwx-vrp4-4pq7 and PYSEC-2026-1471: same summary, same bug, two IDs. Aletheore reports OSV's raw advisory list rather than silently deduping it, so that nuance is visible in the JSON rather than hidden. Which is also why we're flagging it here instead of just quoting "17" and moving on.

These are pinned dev/test dependency versions in this checkout, not a claim about what real Flask deployments run — but they're exactly what a pip install -r requirements-dev.txt would actually pull down today, and every one of them is independently verifiable on osv.dev.

Correct dead-code detection, with a stated reason for each

{
  "unreachable_modules": [
    { "path": "docs/conf.py", "reason": "no other module imports this file" },
    { "path": "examples/celery/make_celery.py", "reason": "no other module imports this file" }
  ]
}

Both are real, legitimate "dead code" by the only definition a deterministic scanner can honestly claim: nothing in the repo imports them. Sphinx invokes docs/conf.py by convention, never by import — exactly the kind of thing a naive dead-code check gets wrong and Aletheore gets right, because it's checking imports, not guessing intent.

A real hotspot, with real co-change data

flask/app.py — 354 commits, most frequently changed alongside CHANGES (87×), flask/helpers.py (58×), and its own test file (41×). That's not a lint rule; it's git history, correctly attributed.

A correctly detected repo license (BSD-3-Clause, read from pyproject.toml) and zero false-positive secret findings across the full working tree and git history.

Express · JavaScript

6,158 commits. 141 files. 21.5k lines.

Scan finished in about six seconds, including a full git-history secrets sweep.

1,284 API endpoints mapped, statically, from source

No server started, no LLM call.

{
  "method": "GET",
  "path": "/restricted",
  "framework": "express",
  "file": "examples/auth/index.js",
  "line": 88,
  "handler": "restrict"
}

Every one of those 1,284 entries carries a real file and line number, extracted from Express's own route-registration calls across its examples and test suite.

One real, current CVE

body-parser@2.2.1 — GHSA-v422-hmwv-36x6, a denial-of-service when an invalid limit value silently disables size enforcement.

Zero secret findings, zero layer-convention violations — Express doesn't declare a layered architecture convention, so Aletheore correctly reports convention_detected: false instead of inventing one.

The point

None of this required an API key, an account, or an LLM call.

The only network traffic was the vulnerability/license registry lookups above, and both are one flag away from off. It's the same evidence a pipx install aletheore && aletheore scan . gets you on your own repo, right now, for free.

Commits scanned: Flask 6a2f545 (2026-07-30), Express a371447 (2026-07-27). Aletheore v0.7.0.

pipx install aletheore Read the source