A self-contained AST-based security scanner that traverses the abstract syntax tree of Python code, detecting calls to blacklisted functions (e.g., system, eval, exec). It demonstrates a clean visitor pattern with minimal dependencies, making it easy to extract and reuse in any project requiring static code analysis. The code is concise, well-documented, and showcases non-obvious use of Python's ast module.

A runtime security monitor that replaces Python's built-in open() function with a secure wrapper that checks file paths against a sensitive keyword list. It demonstrates the technique of monkey-patching for dynamic security enforcement, logging, and raising PermissionError on violations. The module is self-contained and can be extracted to protect any Python application from unauthorized file access, though it modifies global state.

Contains the SandboxRuntime class (lines ~370-450) which executes untrusted code within a restricted environment. It uses sys.settrace to monitor every line execution, function call, and exception, enforcing limits on loop count, operation frequency, and sensitive operations. This is a non-obvious, advanced pattern for runtime behavior monitoring and sandboxing. The class is well-structured with clear separation of monitoring and execution logic, and could be reused as a standalone sandbox with minimal modification.