Python

This guide covers Full Application Reachability (previously Tier 1) via the --reach flag. For an overview of all reachability types, see the Reachability Analysis overview.

Socket supports Full Application Reachability for the following Python package managers:

• pip
• uv
• Poetry
• Anaconda

Prerequisites

Install Socket CLI:

npm install -g socket
socket login

Or set API key:

export SOCKET_SECURITY_API_TOKEN=sktsec_<your_key>

Note: socket scan create requires an org slug. Run socket login to set a default, or pass --org <your-org-slug> on every command.

Runtime requirements for Full Application Reachability:

• uv 0.6.8+ on PATH, for every Python package manager (not just uv projects). Without it, the analysis exits with "Missing required external tools".
• Python 3.11+ for the analysis engine. Your project can use any Python version. If uv can, it installs PyPy for the engine automatically, which speeds up analysis 2–3x.
• pyenv (optional; used to install your project's Python version if it isn't available)

Note: Python is dynamically typed, so reachability analysis is more resource-intensive than statically typed languages. Ensure at least 16 GB RAM is available.

pip

Step 1: Ensure Manifest Exists

Ensure requirements.txt is committed to source control. Run this inside your project's virtual environment, so it captures only the project's packages:

python -m pip freeze > requirements.txt
git add requirements.txt

Socket reads these manifest files directly:

• requirements.txt
• pyproject.toml
• Pipfile.lock (if using Pipenv)

Step 2: Run Baseline Scan

socket scan create .

Note the total CVE count.

Step 3: Run Reachability Scan

socket scan create --reach .

Socket constructs a cross-dependency call graph from source code to determine which CVEs are exploitable. The project does not need to be built first. If a virtual environment exists (.venv, a Poetry environment, or an active conda environment), Socket uses the packages installed there. Otherwise it downloads dependencies itself and prints "Dependencies are not preinstalled. This can result in CVEs with unknown reachability if you use private dependencies".

To run reachability analysis locally without uploading results:

socket scan reach

Results are saved to .socket.facts.json.

Note: Delete .socket.facts.json before running socket scan create without --reach. Otherwise it is uploaded as an SBOM carrying stale reachability results.

Performance Tuning

socket scan create --reach \
  --reach-analysis-timeout 20m \
  --reach-analysis-memory-limit 32GB \
  --reach-concurrency 4 \
  .

uv

Note: Socket recommends uv as the preferred Python package manager for deterministic lockfiles.

Step 1: Ensure Lockfile Exists

Ensure uv.lock is committed to source control:

uv lock
git add uv.lock

Socket reads these manifest files directly:

• pyproject.toml
• uv.lock

Step 2: Run Baseline Scan

socket scan create .

Note the total CVE count.

Step 3: Run Reachability Scan

socket scan create --reach .

Socket constructs a cross-dependency call graph from source code to determine which CVEs are exploitable. The project does not need to be built first. If a virtual environment exists (.venv, a Poetry environment, or an active conda environment), Socket uses the packages installed there. Otherwise it downloads dependencies itself and prints "Dependencies are not preinstalled. This can result in CVEs with unknown reachability if you use private dependencies".

To run reachability analysis locally without uploading results:

socket scan reach

Results are saved to .socket.facts.json.

Note: Delete .socket.facts.json before running socket scan create without --reach. Otherwise it is uploaded as an SBOM carrying stale reachability results.

Performance Tuning

socket scan create --reach \
  --reach-analysis-timeout 20m \
  --reach-analysis-memory-limit 32GB \
  --reach-concurrency 4 \
  .

Poetry

Step 1: Ensure Lockfile Exists

Ensure poetry.lock is committed to source control:

poetry lock
git add poetry.lock

Socket reads these manifest files directly:

• pyproject.toml
• poetry.lock

Step 2: Run Baseline Scan

socket scan create .

Note the total CVE count.

Step 3: Run Reachability Scan

socket scan create --reach .

Socket constructs a cross-dependency call graph from source code to determine which CVEs are exploitable. The project does not need to be built first. If a virtual environment exists (.venv, a Poetry environment, or an active conda environment), Socket uses the packages installed there. Otherwise it downloads dependencies itself and prints "Dependencies are not preinstalled. This can result in CVEs with unknown reachability if you use private dependencies".

To run reachability analysis locally without uploading results:

socket scan reach

Results are saved to .socket.facts.json.

Note: Delete .socket.facts.json before running socket scan create without --reach. Otherwise it is uploaded as an SBOM carrying stale reachability results.

Performance Tuning

socket scan create --reach \
  --reach-analysis-timeout 20m \
  --reach-analysis-memory-limit 32GB \
  --reach-concurrency 4 \
  .

Anaconda

Step 1: Generate requirements.txt from Conda Environment

Anaconda/Conda environments don't produce a standard lockfile that Socket reads directly. Export a requirements.txt from your active conda environment:

conda activate <your-env>
python -m pip list --format=freeze > requirements.txt
git add requirements.txt

Socket reads requirements.txt as the manifest file.

Note: This captures pip-installed packages within the conda environment. Packages installed exclusively via conda install (without a PyPI equivalent) may not appear.

Note: Use pip list --format=freeze rather than pip freeze. In conda environments, pip freeze can emit package @ file:///... lines for conda-built packages instead of version pins.

Step 2: Run Baseline Scan

socket scan create .

Note the total CVE count.

Step 3: Run Reachability Scan

socket scan create --reach .

Socket constructs a cross-dependency call graph from source code to determine which CVEs are exploitable. The project does not need to be built first. If a virtual environment exists (.venv, a Poetry environment, or an active conda environment), Socket uses the packages installed there. Otherwise it downloads dependencies itself and prints "Dependencies are not preinstalled. This can result in CVEs with unknown reachability if you use private dependencies".

To run reachability analysis locally without uploading results:

socket scan reach

Results are saved to .socket.facts.json.

Note: Delete .socket.facts.json before running socket scan create without --reach. Otherwise it is uploaded as an SBOM carrying stale reachability results.

Performance Tuning

socket scan create --reach \
  --reach-analysis-timeout 20m \
  --reach-analysis-memory-limit 32GB \
  --reach-concurrency 4 \
  .

Interpreting Results

View scan results in Socket Dashboard and filter by reachability status.

The CLI outputs a summary table per ecosystem:

Project                 │ Vulns │ Reach │ Unreach │ NoSup │ NoReach │ Skipped │ Error │ Noise% │ Time

Calculate noise reduction manually:

Noise% = ((Unreachable + NoSup + NoReach) / Total Vulns) × 100

Result Categories

In the Dashboard, additional statuses appear: Potentially Reachable (precomputed reachability indirect chain), Pending Precomputation (precomputed reachability processing), Not Determinable, and Unknown.

Triage Reachable CVEs

Review CVEs marked as "Reachable" in Dashboard. For each:

• Check severity and CVSS score
• Evaluate upgrade path
• Prioritize remediation

Override Unreachable CVEs (Optional)

For unreachable CVEs with low business impact, click Override in Dashboard to suppress from future scans.