algobank claims one thing: a file whose hash is in the bank, under its code root, has been algobanked and is secure to the best of algobank's capabilities. Nothing else is claimed.
Where algobank fails
- Native binaries are not parsed. Each is flagged
native binary detected. not checked and must be checked by other means. - Software insurance is not live. No version is insured, no fee is charged and no damages are paid.
- Static analysis can be evaded. Algobank reads code without running it: code that builds its behavior at run time is flagged as
TOP, not understood. - Some dynamic code is missed: functions stored in a dictionary and called by key, introspection through dunder attributes or frames, and the targets of computed
getattr. - Time and randomness are not detected: code that is not deterministic can look pure.
- Python only, with a short table that maps libraries to scope. A library missing from the table is missed.
- Code is checked before it runs, not while it runs. Another package can replace algobanked code in memory, and Algobank does not sandbox or enforce scope at run time.
- Known exploits cover the 1,000 most downloaded PyPI packages, as of the date of the data. Anything reported later, or for other packages, is missing until Algobank is updated.
- Called packages are not analyzed unless they are algobanked in the same run, and the build code of a source distribution is never analyzed.
- Code roots depend on the Python version (3.14): another version can give a different root for the same code.
- The bank has one builder. Independent builders that must agree before a version is admitted are specified, not built.
Disclaimer
Algobank is released under CC0 1.0 Universal and offered as is, without warranties of any kind (CC0, section 4). A report is a signal for review, not a guarantee.