Microsoft DevSkim vs Pysa

Microsoft DevSkim is a free, MIT-licensed toolkit for security linting and static source-code analysis. It provides IDE extensions, language analyzers, and rules to help developers identify and address security vulnerabilities early. It includes built-in rules and allows teams to write their own using JSONPath, XPath, and YmlPath. Listed language support includes C, C++, C#, Cobol, Go, Java, JavaScript/TypeScript, and Python, among others. Its cross-platform .NET CLI analyzes files and directories and can be installed as a global tool or obtained as binaries for Windows, macOS, and Linux. A C# library is also available for embedding analysis in other tools. Results can be emitted as SARIF, JSON, or text; the CLI can apply suggested fixes from SARIF results and add suppression comments. The project lists extensions for Visual Studio Code and Visual Studio, and supports CI/CD in self-hosted environments. Support is limited to GitHub issues and project wiki resources. Vulnerability reports should be sent privately to Microsoft's Security Response Center rather than posted publicly.

Pysa is a free, open-source Python static analysis tool that uses taint analysis to identify potential security issues. It follows data from configured sources toward dangerous sinks, such as user-controlled request data reaching an eval call. Users configure sources, sinks, features and rules in taint.config, and annotate code with .pysa model files; built-in and common Python libraries have prewritten models and rules. Sanitizer models describe data that should lose taint, including function parameters and return values. Pysa analyzes the target repository and directories in the configured search_path, but not dependency source outside that scope. When it cannot access a function’s source, it assumes the return value retains taint, which can lead to false positives. Analysis may freeze on similarly sized projects if the machine lacks enough memory. The quickstart installs it with pip install pyre-check in a Python virtual environment. Pyre supports the Language Server Protocol, and a VSCode extension connects to a running server. SAPP can ingest results for viewing and filtering in a local web UI; a GitHub Action can run Pysa in CI and show findings in GitHub’s Security code scanning UI. Pysa requires Python 3.9 or later and relies on type information from Pyrefly. The project says it can analyze codebases with millions of lines. Its repository is MIT-licensed; the Pyre repository was archived on June 26, 2026, and says Pysa moved to its own repository.