00 / CONCURRENCY INSPECTOR

Your code has a race condition.
Watch it happen.

Find read-modify-write races, reproduce them under pressure, and patch them without touching your formatting.

Join GitHub App waitlist

sourcethreadslock

LOCAL-ONLY ANALYSISMIT LICENSEPYTHON 3.9+

ILLUSTRATIVE SIMULATION / CG-016× RACE PATH

wallet.balance100starting balance

Request Athr-17

get() → 100

Request Bthr-18

get() → 100

01 / 05

Both requests read the same balance.

01 / DETECT

The bug, line by line.

cguard follows the read, the check, and the write — even when they are separated by application code.

CG-016 / VULNERABLE

race window

01def deduct(user_id, amount):02    wallet = Wallet.objects.get(id=user_id)03    if wallet.balance < amount:04        raise InsufficientFunds()05    wallet.balance -= amount06    wallet.save()

RECORDED SCAN / cguard 2.1.02026-11-03

$ cguard scan examples/vulnerable_wallet.py --format json

CG-001  examples/vulnerable_wallet.py:51
      function: withdraw
CG-002  examples/vulnerable_wallet.py:46
      function: withdraw

✓ JSON transcript captured locally

files: 1
findings: 2
elapsed: 7.83 ms

REAL RECORDED OUTPUT

02 / TRACE

One path from finding to fix.

Every stage leaves evidence you can inspect locally.

02.1

Trace the call path

A route can delegate a mutation three files away. The call graph keeps the connection intact.

routes.py→service.py→cache.py / mutate()

02.2

Follow shared state

Taint tracking follows a mutable reference through aliases, arguments, and attribute access.

global_cache↘ alias ↘ argumentitems.append()

02.3

Force the interleaving

The runtime verifier releases workers at a barrier, then compares the observed state with the invariant.

worker 01worker 02worker 03BARRIER14 / 50 increments observed

02.4

Patch without reformatting

LibCST makes a narrow source edit and preserves the comments and layout already in your file.

# keep this audit note~~Wallet.objects.get(...)~~Wallet.objects.select_for_update().get(...)

03 / COVERAGE

Specific checks, named plainly.

Every displayed number has a source. Modeled timeline outcomes are labeled as simulations.

16: documented rules
recorded · 2026-11-03
0: network calls required
recorded · 2026-11-03
8: analysis surfaces
ORM, async, threads, files, cache, locks, tasks, Python

04 / CATALOG

The rules are visible.

Sixteen documented checks across ORM, runtime, file, cache, and lock behavior.

Rule	Framework	Pattern	Auto-fix
CG-001	SQLAlchemy / FastAPI	Unlocked read-modify-write	Yes
CG-002	FastAPI	Missing idempotency header	Yes
CG-003	asyncio / SQLAlchemy	Query inside async loop	No
CG-004	SQLAlchemy	Check-then-act uniqueness	Yes
CG-005	Celery	Non-idempotent retry	No
CG-006	asyncio	Shared-state mutation	Yes
CG-007	threading	Threaded collection mutation	Yes
CG-008	Python	Generic read-modify-write	No
CG-009	Filesystem	Concurrent file write	Yes
CG-010	Filesystem	Shared tempfile	No
CG-011	Redis / cache	Cache check-then-act	No
CG-012	Cache	Non-atomic invalidation	No
CG-013	Locks	Lock-order inversion	No
CG-014	Python	Cross-file call-chain race	No
CG-015	Python	Tainted shared-state mutation	No
CG-016	Django	Unlocked ORM mutation	Yes

05 / RUN LOCALLY

No account. No upload. No detour.

Install the CLI, scan a path, and review the source-preserving patch on your own machine.

PRIVACY / Nothing leaves your machine. cguard parses source with Python AST and LibCST locally.

06 / GITHUB APP

Put the finding on the pull request.

Early access for a GitHub App that turns a detected race into a reviewable patch.

ccguard botcommented now

CG-016 unlocked Django mutation in wallet.py:12

Wallet.objects.get(id=user_id)
Wallet.objects.select_for_update().get(id=user_id)