Bandit vs Pysa

Bandit is free software for finding common security issues in Python source code. It builds an abstract syntax tree from scanned files and runs plugins against that tree, then produces a report. A JSON baseline can exclude findings that a team considers non-issues. The project is distributed through PyPI and recommends installation with pip. It runs on Linux and macOS and can be used in self-hosted environments. Optional installation extras add TOML support, the bandit-baseline command-line tool, and SARIF output formatting. Documentation describes pre-commit configuration and integrations with Visual Studio Code, Sublime Text, Vim, Neovim, Emacs, GitHub Actions, Jenkins, Ruff, and Flake8. A published container image supports amd64, arm64, armv7, and armv8 architectures. The project says images are signed with Sigstore Cosign and provides source-verification instructions. Bandit is licensed under Apache License 2.0, with support links to GitHub issues and Discord.

Pysa is a free, open-source Python static analysis tool that uses taint analysis to identify potential security issues. It follows data from configured sources toward dangerous sinks, such as user-controlled request data reaching an eval call. Users configure sources, sinks, features and rules in taint.config, and annotate code with .pysa model files; built-in and common Python libraries have prewritten models and rules. Sanitizer models describe data that should lose taint, including function parameters and return values. Pysa analyzes the target repository and directories in the configured search_path, but not dependency source outside that scope. When it cannot access a function’s source, it assumes the return value retains taint, which can lead to false positives. Analysis may freeze on similarly sized projects if the machine lacks enough memory. The quickstart installs it with pip install pyre-check in a Python virtual environment. Pyre supports the Language Server Protocol, and a VSCode extension connects to a running server. SAPP can ingest results for viewing and filtering in a local web UI; a GitHub Action can run Pysa in CI and show findings in GitHub’s Security code scanning UI. Pysa requires Python 3.9 or later and relies on type information from Pyrefly. The project says it can analyze codebases with millions of lines. Its repository is MIT-licensed; the Pyre repository was archived on June 26, 2026, and says Pysa moved to its own repository.