---
id: dodgy
version: "0.2.1"
license: MIT
license_treatment: permissive
maintenance: abandoned
---

# dodgy — Dodgy: Searches for dodgy looking lines in Python code

License: permissive · Maintenance: abandoned · Downloads: 672.1K/mo

## What it is and what it does

Dodgy is a lightweight static analysis tool that searches Python codebases for suspicious code patterns using regular expressions. It targets common security oversights like accidental version control markers, hardcoded passwords, and embedded API keys—problems particularly dangerous in open-source projects where secrets become publicly visible. The tool is designed to run as a pre-commit hook to catch these issues before code is checked in.

The package has no runtime dependencies and installs cleanly, but it is no longer maintained. The last release was in late 2019 and the last repository commit in mid-2021. While it still functions on supported Python versions, it will not evolve to handle new secret patterns, modern Python syntax, or compatibility issues with newer language versions.

Use it for:

- Run as a pre-commit hook in open-source projects to prevent accidental exposure of API keys or credentials.
- Scan legacy codebases for hardcoded secrets before migrating to a secrets-management system.
- Quick baseline check in CI/CD pipelines for obvious security oversights in Python files.
- Integrate into code review workflows to flag suspicious patterns before merge.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Dodgy scans Python source code for suspicious patterns—accidental diff markers, hardcoded passwords, and secret keys—using simple regular expressions to catch potentially dangerous code before it's committed.

No—not for new projects. Dodgy is abandoned and unmaintained since 2021. For active codebases, use a modern alternative like detect-secrets, truffleHog, or a dedicated secrets scanner that receives updates. If you maintain legacy code already using dodgy and it still works on your Python version, keeping it is low-risk, but do not adopt it for new work.

## Install

pip install dodgy
uv add dodgy
poetry add dodgy

## Installing dodgy

Before you install: Installation is frictionless with no runtime dependencies. However, the project is abandoned—last release was 2019-12-31 and last commit 2021-08-29—so it will not receive bug fixes, security updates, or compatibility patches for modern Python versions.

License in practice: MIT license is permissive and poses no restrictions on use, modification, or distribution in commercial or private projects.

Quickstart:

pip install dodgy==0.2.1
python -m dodgy /path/to/code

Project is abandoned; compatibility with Python versions beyond 3.8 is untested and unsupported.

Verify before relying:

- Whether the regex patterns remain effective at detecting modern secret formats and obfuscation techniques.
- Compatibility status with Python 3.9 and later versions despite classifiers only listing up to 3.8.
- Whether false-positive rate is acceptable for typical codebases.

## Package facts

- License: MIT (permissive)
- Python support: unspecified
- Install friction: low
- Maintenance: abandoned
- Downloads: 672.1K/month (top 15,000 on PyPI)
- Known vulnerabilities: none known

## Tags

detect hardcoded secrets in code, find suspicious code patterns, pre-commit security scanning, password detection in source, code quality linting tool, abandoned, pre-commit-hook, secrets-detection

[View on SkillFed](https://skillfed.io/packages/dodgy) · [View on PyPI](https://pypi.org/project/dodgy/)