Very interesting, will definitely check it out. Wondering if you know how this compares to SonarQube, in terms of actionable advice and accuracy?

> A key security risk is Python’s ability to easily execute arbitrary code provided as data, which is a common mechanism in various injection and remote code execution (RCE) attacks.

In other words, it has the `eval` and `exec` builtins.

This is spun up to multiple paragraphs of blatantly-LLM-generated prose, decorated with a diagram of how Python programs represent a large attack surface by... being permitted to do the things that programs in every language are ordinarily permitted to do, and then capped off with promotion for some sort of threat scanning tool (and the rest of the article clearly exists solely for the purpose of introducing that promotion).

In short, this is spam completely lacking in insight.