How Long Does a BrassCoders Scan Take?

Under 60 Seconds on a Typical Codebase

BrassCoders's full 12-scanner suite runs in under 60 seconds on most Python projects — fast enough for a pull-request CI check without adding meaningful latency to the merge queue.

The CI configuration in BrassCoders's own documentation targets ubuntu-latest GitHub Actions runners. On a standard Python codebase (a few thousand lines, a typical FastAPI or Django app), the scan completes well under 60 seconds (https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/using-jobs-in-a-workflow).

The fast path: Bandit, Semgrep, ast-grep, detect-secrets, and the six custom scanners (secret-pattern, privacy/PII, AI-pattern, performance, content-moderation, JavaScript-TypeScript) all run quickly. Most of the scan time is filesystem I/O and Python startup overhead, not scanner complexity.

What Affects Scan Time

BrassCoders's slowest scanner is Pyre/Pysa, Meta's interprocedural taint analyzer — it builds a type inference graph across the entire codebase before scanning, which takes seconds on small projects and minutes on large codebases with deep import trees.

Pyre/Pysa (https://pyre-check.org/docs/pysa-basics/) performs whole-project taint analysis. It traces data flows from untrusted sources (HTTP request parameters, environment variables) to security-sensitive sinks (database queries, subprocess calls). That analysis requires building a type graph, which scales with the number of files and the depth of your import tree.

Two variables dominate scan time:

• Project size: A 5,000-line project scans faster than a 50,000-line project.
• Pyre/Pysa warm-up: First run on a project is slower; subsequent runs benefit from incremental analysis.

If your project is large and scan time is a concern, .brassignore lets you exclude directories (test fixtures, generated code, vendored dependencies) from the scan. Excluding vendor/ or node_modules/ cuts both scan time and finding noise.

Install BrassCoders with pip install brasscoders and run brasscoders scan . from your project root. The OSS core is free and Apache 2.0 licensed. BrassCoders Paid adds semantic noise reduction for $12/dev/month.