Algorand contract security that feels operational.
Trusted PyTeal & TEAL security signals from local development to production gates — fast to run, easy to review, and strict where it matters.
Live workflow preview
From pasted code to security report
A structured analysis path from contract code to exportable vulnerability report.
Code Input & Parsing
Paste your PyTeal or TEAL contract. The parser validates syntax and builds the AST for analysis.
Static Analysis
16 detectors scan for reentrancy, unchecked math, access control violations, and ABI misuse.
Severity Classification
Findings are classified as Critical, High, Medium, or Low and grouped into triage lanes.
Report Generation
Structured reports with line-level fix recommendations exported as JSON or text.
Understand the workflow in under a minute.
Choose a command path and preview realistic output.
algosec analyze contracts/Vault.pyRun all 16 detectors against a PyTeal contract file.
algosec analyze contracts/Token.teal --type reentrancyCheck for reentrancy and state manipulation vulnerabilities.
algosec analyze contracts/AMM.py --format jsonGenerate machine-readable JSON output for CI pipelines.
algosec analyze contracts/ --depth 3 --allDeep recursive scan across an entire contracts directory.
CLI-first
Predictable command outputs for local and CI pipelines.
Safe by default
Read-only analysis with no contract state changes.
Audit ready
Exportable reports keep review trails transparent.
How teams actually use AlgoSec
Practical usage patterns from first local scan to CI gating and audit reporting.
Why teams keep AlgoSec in CI
Teams adopt AlgoSec because it behaves the same in local runs and in CI.
- →Deterministic output keeps triage stable
- →Severity policy stays consistent from PR to release
- →Fix planning remains reviewer-led
- →JSON export supports post-deploy verification
How an analysis executes
Each scan follows one clear pipeline: code parsing, detector execution, severity scoring, and report synthesis.
- →Input guardrails reject empty or invalid code
- →Pattern + AST checks reduce false positives
- →Severity levels map cleanly to deployment risk
- →CLI, JSON, and text outputs remain consistent
Remediation guidance
Each finding includes a concrete fix recommendation.
- →Context-aware fix suggestions per vulnerability
- →Impact descriptions help teams prioritize
- →Line-level annotations for quick navigation
Operational rollout
Roll out in phases: local developer checks first, PR gates next, then release policy enforcement.
- →Use severity thresholds to fail unsafe builds
- →Run quick analysis on every PR to mainnet
- →Generate stats and graphs for audit reporting