Skip to content
SPECIFICTION
Get listed

Pysa

pyre-check.org

Free plan WindowsmacOSLinuxSelf-hostedBrowser extension
Visit pyre-check.org
Spec score 8.3 #6 of 25 in Static Application Security Testing Software

What it is

Pysa is a free, open-source Python static analysis tool that uses taint analysis to identify potential security issues. It follows data from configured sources toward dangerous sinks, such as user-controlled request data reaching an eval call. Users configure sources, sinks, features and rules in taint.config, and annotate code with .pysa model files; built-in and common Python libraries have prewritten models and rules. Sanitizer models describe data that should lose taint, including function parameters and return values. Pysa analyzes the target repository and directories in the configured search_path, but not dependency source outside that scope. When it cannot access a function’s source, it assumes the return value retains taint, which can lead to false positives. Analysis may freeze on similarly sized projects if the machine lacks enough memory. The quickstart installs it with pip install pyre-check in a Python virtual environment. Pyre supports the Language Server Protocol, and a VSCode extension connects to a running server. SAPP can ingest results for viewing and filtering in a local web UI; a GitHub Action can run Pysa in CI and show findings in GitHub’s Security code scanning UI. Pysa requires Python 3.9 or later and relies on type information from Pyrefly. The project says it can analyze codebases with millions of lines. Its repository is MIT-licensed; the Pyre repository was archived on June 26, 2026, and says Pysa moved to its own repository.

Spec sheet

Purpose
Pysa is a security-focused static analysis tool for Python that tracks data flows to find security and privacy issues.Read 8 Oct 2026 · github.com
Platforms
The installation page recommends its PyPI binary distribution for macOS and Linux; it says Windows use via WSL has worked but is not officially supported.Read 4 Oct 2026 · pyre-check.org
License
Pysa is licensed under the MIT license.Read 8 Oct 2026 · github.com
Analysis limitation
Pysa analyzes code in the repository and configured search paths, but does not see dependency source code outside those paths.Read 8 Oct 2026 · pyre-check.org
Analysis scope
Pysa analyzes code in the target repository and directories listed in the configuration search_path; it does not see dependency source code otherwise.Read 4 Oct 2026 · pyre-check.org
Built-in coverage
Pysa includes pre-written models and rules for built-in and common Python libraries.Read 8 Oct 2026 · pyre-check.org
CI integration
A GitHub Action can run Pysa in CI and show results in GitHub's Security code scanning UI.Read 8 Oct 2026 · github.com
Codebase scale
The Pysa repository says it can analyze codebases with millions of lines of code.Read 8 Oct 2026 · github.com
Data flow analysis
Pysa tracks data from sources to dangerous sinks, such as user-controlled request data reaching an eval call.Read 4 Oct 2026 · pyre-check.org
Editor integration
Pyre supports the Language Server Protocol and provides a VSCode extension that connects to a running server.Read 4 Oct 2026 · pyre-check.org
Filtering trade-off
The Pysa Action documentation says its default SAPP filters aim for higher-signal results and may trade false positives for false negatives.Read 8 Oct 2026 · github.com
Installation
Pysa is currently distributed as part of the pyre-check package and can be installed with pip install pyre-check.Read 8 Oct 2026 · github.com
Known limitation
When Pysa encounters a function whose source it cannot access, it assumes the function's return value has the same taint, which can cause false positives.Read 4 Oct 2026 · pyre-check.org
Known trade-off
The documentation says Pysa may produce false positives when it lacks a function's source and assumes the return value retains taint.Read 8 Oct 2026 · pyre-check.org
Maintenance status
The Pyre repository says it was archived on June 26, 2026, and that Pysa moved to its own repository.Read 4 Oct 2026 · github.com
Models and rules
Users configure sources, sinks, features, and rules in taint.config and model files with the .pysa extension.Read 8 Oct 2026 · pyre-check.org
Requirements
Pysa requires Python 3.9 or later and currently relies on type information from Pyrefly.Read 8 Oct 2026 · github.com
Resource needs
The quickstart says Pysa may freeze during analysis on projects of similar size when the machine does not have enough memory.Read 4 Oct 2026 · pyre-check.org
Results interface
The documented quickstart uses SAPP to ingest Pysa results and view and filter issues in a local web UI.Read 8 Oct 2026 · pyre-check.org
Results workflow
The quickstart uses SAPP to ingest Pysa results and provides a web UI for viewing and filtering issues.Read 4 Oct 2026 · pyre-check.org
Sanitizers
Pysa models sanitizers that remove taint from data, including annotations for sanitizing return values and parameters.Read 4 Oct 2026 · pyre-check.org
Security reporting
The Pysa security policy asks users to report security issues through Meta's Bug Bounty program rather than public GitHub issues or pull requests.Read 8 Oct 2026 · github.com
Taint analysis
Pysa tracks data from sources to dangerous sinks, such as user-controlled input reaching an eval call.Read 8 Oct 2026 · pyre-check.org

Plans and prices

Free (MIT-licensed open-source software) Free Python static analysis; install with pip Read 8 Oct 2026 · github.com

Every Pysa plan and price →

Strong points and limits

Strong points

  • Tracks tainted data from sources to dangerous sinks
  • Includes models for built-in and common libraries
  • Sanitizer models cover parameters and return values
  • GitHub Action can run analysis in CI
  • Can analyze codebases with millions of lines

Limits

  • Does not analyze dependency source outside configured paths
  • Missing function source can cause false positives
  • Analysis may freeze when memory is insufficient
  • Requires Python 3.9 or later

Who it suits

Pysa suits Python teams that want static security analysis based on configured data flows, including teams running checks in CI. Users need to account for its configured analysis scope, memory needs and possible false positives.

Verdict

Pysa offers configurable taint analysis, editor integration and CI support for Python code. Its findings depend on the available analysis scope and memory, and inaccessible function source can add false positives.

Where Specifiction places it

Alternatives to PysaAll alternatives →