Static-analysis Libraries

An extremely fast Python linter and code formatter, written in Rust. Ruff aims to be orders of magnitude faster than alternative tools while integrating more functionality behind a single, common int…

An extremely fast Python linter, written in Rust. Ruff aims to be orders of magnitude faster than alternative tools while integrating more functionality behind a single, common interface. Ruff is ext…

Version: v3.6 beta Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of pe…

We start by creating an empty project directory and setting up a virtual environment: Next, we teach Pyre about our new project: We are now ready to run Pyre: Pyre is licensed under the MIT license.

Pytype checks and infers types for your Python code - without requiring type annotations. Pytype can: Pytype is a static analyzer; it does not execute the code it runs on. Thousands of projects at Go…

Flake8 is a wrapper around these tools: It also adds a few features: files that contain this line are skipped: Git and Mercurial hooks We would love to hear from you. Additionally, if you have a feat…

Anchore Engine is an open-source project that provides a centralized service for inspection, analysis, and certification of container images. Anchore Engine is provided as a Docker container image th…

A curated list of awesome Python security related resources.

Small security related tools created in Python and Bash for CTF players, bug bounty hunters, pentesters and developers.

Usually, the master branch is deployed as soon as Pull Requests are merged in the repository. However, on every Friday, I make a release and make sure the latest code is deployed. You do not need to …

Usually, the master branch is deployed as soon as Pull Requests are merged in the repository. However, on every Friday, I make a release and make sure the latest code is deployed. You do not need to…

Developers can set up a new stage into their CI pipelines to check for vulnerabilities: If security issues are found in the code, the severity, the confidence, the file, the line, and many more usefu…

“For those who like dinosaurs 🦖 and clean try/except ✨ blocks.” OR You can enable experimental analyzers by running: You can also autofix some violations: If you want to ignore a violation in a speci…

Basic script to detect vulnerabilities into a PHP source code, it is using Regular Expression to find sinkholes. Currently detecting : if you want to export each vulnerabilities type into a folder us…

Dlint is a tool for encouraging best coding practices and helping ensure Python code is secure. The most important thing I have done as a programmer in recent years is to aggressively pursue static c…

A plugin to run security checks for common flaws in Python code and suggest quick fixes. Check out the webinar for a full demo of the functionality in this plugin: This plugin will check the installe…

Pyanalyze is a tool for programmatically detecting common mistakes in Python code, such as references to undefined variables and type errors. It can be extended to add additional rules and perform ch…

Checks syntax of reStructuredText and code blocks nested within it. Contents From pip To use pyproject.toml for configuration: To add sphinx support: With bad Python syntax: With bad C++ syntax: With…

Dlint is a tool for encouraging best coding practices and helping ensure Python code is secure. The most important thing I have done as a programmer in recent years is to aggressively pursue static c…

For those interested in the research output produced in my MSc thesis: Or if your project uses Pipenv: In CI scripts, such raw markdown output (whether as a file or printed to the standard output) ca…