Launched this week
Python Code Audit
Modern Python source code security analyzer.
9 followers
Modern Python source code security analyzer.
9 followers
Python Code Audit is a Static Application Security Testing (SAST) tool used to find security weaknesses in Python code. This tool is created for: * Python Users who want to assess the security risks in the Python code they use. * Python Developers: Anyone, from professionals to hobbyists, who wants to deliver secure Python code. * Security-Conscious Users: People seeking a simple, fast way to gain insight into potential security vulnerabilities within Python packages or files.
Python Code Audit
Static analysis has become crowded lately. What types of Python issues do you consistently catch that other analyzers tend to miss?
@aryan787544 Thanks for your questions!
"Static analysis has become crowded lately."
True! But all powered by AI and/or SaaS. From a security point of view, using a SaaS solution on your own code is not recommended. The truth is, you simply cannot know if your code is being copied to a remote location and which third parties will gain access to it. Of course, it is a matter of 'trust'...
I created this tool because I could not find a good FOSS Python scanner that is simple, quick to use, and can be trusted.
What types of Python issues do you consistently catch that other analyzers tend to miss?
Most commercial Python SAST scanners are severely limited when catching simple weaknesses in Python Standard Library (PSL) calls—specifically, calls based on modules that are part of the standard Python distribution. A SAST scanner that misses crucial calls gives you a false sense of security. This Python SAST scanner was built on the principle of zero trust, giving me the simple, direct insights I need as a security researcher. By default, it scans Python code against more than 89 rules to detect potential security vulnerabilities, targeting unsafe constructs in the standard Python libraries that could pose a risk.
Regards!
@maikelmardjan Thanks for taking the time to explain.
I'd rather not continue this discussion in a public thread.
If you're open to it, what's the best email to reach you?
Ran it against a few scripts I had lying around and the output was refreshingly clear without drowning me in false positives. Glad to have a lightweight SAST option that doesn't need a whole security team to interpret.
@mehtap1440866 Thanks for this great input!
I keep on working to make this tool easier and simpler to use. This is a real challenge! Simple is hard to accomplish! I was really frustrated with complex SAST tools that takes too much time to run on code of others. And most tool require you to create your own rules sets, since the basic checks are too limited imho.
The WASM based version is now really simple to check security weaknesses on any package hosted on PyPI.org . Security is never black or white: Context matters. This is why this tool is focussed on identifying potential security weaknesses. All vulnerabilities are weaknesses, but not all weaknesses are vulnerabilities.
Love how the README spells out exactly who benefits from this, dev or hobbyist, instead of vague enterprise speak. Running it locally to scan a Flask project feels like exactly the kind of low-friction security check more Python folks should have in their toolbox.
@adilaraculb7 Thank you for these nice words and valuable input! Looks like you read my manifest!