Open Source Python Static Code Analysis Tools

Bandit is a tool designed to find common security issues in Python code. To do this, Bandit processes each file, builds an AST from it, and runs appropriate plugins against the AST nodes. Once Bandit has finished scanning all the files, it generates a report. Bandit was originally developed within the OpenStack Security Project and later rehomed to PyCQA.

A GitHub app to automatically review Python code style over Pull Requests. PEP 8 Speaks is a GitHub integration which detects Python code style issues on new Pull Requests. You can install it on your Python projects and configure with your own code style. Check out the project on GitHub. Maintainers of Python projects have a difficult time reviewing Pull Requests by new contributors who may not be aware of the code style. This project makes reviewing Pull Requests a little bit easier. Style issues get lost in the long CI build logs and the authors of the Pull Requests are not notified about them (unless flake8 is strict about failing the build). Thus, new issues are overlooked and introduced in the project. PEP 8 Speaks can read the setup.cfg file and adopt your already existing flake8/pycodestyle settings. PEP 8 Speaks is free of cost. By default, it can not work on private repositories.

Pylint is a static code analyzer for Python 2 or 3. The latest version supports Python 3.7.2 and above. Pylint analyses your code without actually running it. It checks for errors, enforces a coding standard, looks for code smells, and can make suggestions about how the code could be refactored. Projects that you might want to use alongside pylint include flake8 (faster and simpler checks with very few false positives), mypy, pyright or pyre (typing checks), bandit (security-oriented checks), black and isort (auto-formatting), autoflake (automated removal of unused import or variable), pyupgrade (automated upgrade to newer python syntax) and pydocstringformatter (automated pep257). Pylint isn't smarter than you: it may warn you about things that you have conscientiously done or checks for some things that you don't care about. During adoption, especially in a legacy project where pylint was never enforced.

Tencent Cloud Code Analysis (TCA for short, used internally by the R&D code CodeDog ) is a cloud-native, distributed, high-performance comprehensive code analysis and tracking platform that integrates many analysis tools, including server, web and client The three components have integrated a number of self-developed tools, and also support the dynamic integration of analysis tools of various programming languages ​​in the industry. Obtain the Tencent Cloud code analysis platform by deploying TCA Server and Web, and complete the creation of related projects on the platform. After the project is created, you can deploy and configure the Tencent Cloud code analysis client to perform code analysis locally or as an online resident node. Before starting your first code analysis project, you need to deploy the Tencent Cloud Code Analysis client locally. After completing the project configuration on the client, you can start your first code analysis project and view your analysis results.

CodeCat is a open source tool to help you in static code analysis, to find/track sinks and bugs, this points follow regex rules...

mobsfscan is a fast and powerful static analysis tool for identifying security vulnerabilities in mobile app source code. It supports Android, iOS, and Flutter codebases and helps developers secure apps before deployment.