Pysa

6.4easy start · #14 of 25
in Static Application Security Testing Software

Free to practise onnot on record
Free trialnot on record
Well documentedyes
Runs where you workyes

Runs on Browser, Linux, Mac, Windows.

Pysa is ranked #14 of 25 in static application security testing software on The Geeks Club. It runs on Browser extension, Linux, macOS, Windows.

Compared on static application security testing software

Analysis target: source
CI/CD support: Yes
Deployment: self-hosted

Best Pysa alternatives

See all 20

Skylos 0 of 4 in the starter kit Lesson 18.0 Puma Scan 0 of 4 in the starter kit Lesson 27.9 Snyk Open Source 0 of 4 in the starter kit Lesson 37.4 Horusec 0 of 4 in the starter kit Lesson 47.3 MobSF 0 of 4 in the starter kit Lesson 57.3 Semgrep Code 0 of 4 in the starter kit Lesson 67.3

The record

Purpose: Pysa is a Python static analysis tool that uses taint analysis to identify potential security issues.
Data flow analysis: Pysa tracks data from sources to dangerous sinks, such as user-controlled request data reaching an eval call.
Models and rules: Users configure sources, sinks, features, and rules in taint.config and annotate code with .pysa model files.
Built-in coverage: Pysa includes prewritten models and rules for built-in and common Python libraries.
Sanitizers: Pysa models sanitizers that remove taint from data, including annotations for sanitizing return values and parameters.
Installation: The quickstart installs Pysa with pip install pyre-check in a Python virtual environment.
Platforms: The installation page recommends its PyPI binary distribution for macOS and Linux; it says Windows use via WSL has worked but is not officially supported.
Editor integration: Pyre supports the Language Server Protocol and provides a VSCode extension that connects to a running server.
Results workflow: The quickstart uses SAPP to ingest Pysa results and provides a web UI for viewing and filtering issues.
Analysis scope: Pysa analyzes code in the target repository and directories listed in the configuration search_path; it does not see dependency source code otherwise.
Known limitation: When Pysa encounters a function whose source it cannot access, it assumes the function's return value has the same taint, which can cause false positives.
Resource needs: The quickstart says Pysa may freeze during analysis on projects of similar size when the machine does not have enough memory.
License: The Pysa repository states that Pysa is licensed under the MIT license.
Maintenance status: The Pyre repository says it was archived on June 26, 2026, and that Pysa moved to its own repository.

Where it ranks on The Geeks Club

Best Static Application Security Testing Software in 2026#14 of 25

Is Pysa yours?

Claim it for free: prove the domain, then correct facts, plans and screenshots. An editor reviews every change.

Claim it free Promote Pysa

Sources

pyre-check.org/docs/pysa-basics/· checked 4 Oct 2026
pyre-check.org/docs/pysa-quickstart/· checked 4 Oct 2026
pyre-check.org/docs/installation/· checked 4 Oct 2026
github.com/facebook/Pysa· checked 4 Oct 2026
github.com/facebook/pyre-check· checked 4 Oct 2026