What an event proves

[eyal-gabay]

You will check our claims, and you should. Here is what stands behind an event, in one place.

What an event proves. Untrusted data, from a source you switched on, really reached a dangerous operation in your running program. The event carries the value at both ends and the call path.

How to read it. An allow-list check or an equality test earlier in your code can make a flow harmless, and the event gives you what you need to judge it.

What stays silent. A correctly parameterized query: the check is on the statement text, never on a bound parameter. A value the product recognizes as made safe for that operation is suppressed, and you can still see it under Suppressed events.

Scope.

• You choose what it watches, so measure it on your own workload.
• Blocking (Raise) is opt-in, per rule. At a small number of operations that cannot be interrupted part-way, the error is raised immediately after the operation rather than before it.
• Runs on Linux, x86_64 and aarch64, Python 3.9, 3.10, 3.11, 3.12, 3.13 and 3.14.

Keep your static analysis, WAF and dependency scanner; each does its own job, and es-python adds the view from inside the running program.

Which of these matters most for your workload?