dodgy

What it is and what it does

Dodgy is a lightweight static analysis tool that searches Python codebases for suspicious code patterns using regular expressions. It targets common security oversights like accidental version control markers, hardcoded passwords, and embedded API keys—problems particularly dangerous in open-source projects where secrets become publicly visible. The tool is designed to run as a pre-commit hook to catch these issues before code is checked in.

The package has no runtime dependencies and installs cleanly, but it is no longer maintained. The last release was in late 2019 and the last repository commit in mid-2021. While it still functions on supported Python versions, it will not evolve to handle new secret patterns, modern Python syntax, or compatibility issues with newer language versions.

Use it for:

• Run as a pre-commit hook in open-source projects to prevent accidental exposure of API keys or credentials.
• Scan legacy codebases for hardcoded secrets before migrating to a secrets-management system.
• Quick baseline check in CI/CD pipelines for obvious security oversights in Python files.
• Integrate into code review workflows to flag suspicious patterns before merge.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Dodgy scans Python source code for suspicious patterns—accidental diff markers, hardcoded passwords, and secret keys—using simple regular expressions to catch potentially dangerous code before it's committed.

No—not for new projects. Dodgy is abandoned and unmaintained since 2021. For active codebases, use a modern alternative like detect-secrets, truffleHog, or a dedicated secrets scanner that receives updates. If you maintain legacy code already using dodgy and it still works on your Python version, keeping it is low-risk, but do not adopt it for new work.

Install

dodgy on PyPI

pip install dodgy

uv add dodgy

poetry add dodgy

Installing dodgy

Before you install

Installation is frictionless with no runtime dependencies. However, the project is abandoned—last release was 2019-12-31 and last commit 2021-08-29—so it will not receive bug fixes, security updates, or compatibility patches for modern Python versions.

License in practice

MIT license is permissive and poses no restrictions on use, modification, or distribution in commercial or private projects.

Quickstart

pip install dodgy==0.2.1
python -m dodgy /path/to/code

Project is abandoned; compatibility with Python versions beyond 3.8 is untested and unsupported.

Verify before relying

• Whether the regex patterns remain effective at detecting modern secret formats and obfuscation techniques.
• Compatibility status with Python 3.9 and later versions despite classifiers only listing up to 3.8.
• Whether false-positive rate is acceptable for typical codebases.

Package facts

Evidence: dodgy-0.2.1-py3-none-any.whl

Keywords: check, for, suspicious, code

Tags

More Quality Assurance packages