pyre-check

What it is and what it does

Pysa is a security-focused static analyzer built on top of Pyrefly, Meta's Python type checker. It works by tracking how untrusted data (sources) flows through your code to dangerous operations (sinks), flagging paths that could lead to security vulnerabilities. The tool is designed to scale to large codebases and uses configurable models to identify sources and sinks relevant to your application.

You run Pysa after Pyrefly has successfully type-checked your code. It produces a report of potential security and privacy issues without executing your code. The tool ships as part of the pyre-check package and relies on a chain of dependencies including libcst for code parsing, click for CLI, and several typing utilities.

Use it for:

• Scan a web application for user input reaching SQL queries or shell commands.
• Identify privacy violations where sensitive data flows to external APIs or logs.
• Integrate security scanning into CI/CD pipelines via the GitHub Action.
• Analyze large Python codebases for data exfiltration or injection vulnerabilities.
• Enforce security policies by configuring custom taint sources and sinks for your domain.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Pysa is a static analysis tool that tracks data flows through Python code to identify security and privacy vulnerabilities like SQL injection and remote code execution, scaling to codebases with millions of lines.

Yes, if you need automated security scanning for Python. Pysa is actively maintained, has no known vulnerabilities, and scales to large codebases. Install it when your team wants continuous data-flow analysis without manual code review. Requires Python 3.9+, Pyrefly setup, and willingness to configure models for your specific threats.

Install

pyre-check on PyPI

pip install pyre-check

uv add pyre-check

poetry add pyre-check

Installing pyre-check

Before you install

Medium install friction due to 12 runtime dependencies and platform-specific wheels (macOS ARM64, Linux x86_64). Active maintenance with recent release (8 days old) and ongoing repository activity supports reliability.

License in practice

MIT license is permissive; you can use, modify, and distribute Pysa with minimal restrictions, making it suitable for both open-source and commercial projects.

Quickstart

pip install pyre-check
pyrefly check
pyre analyze

Requires Python 3.9 or later; Pyrefly must successfully type-check your code before Pysa can analyze it.

Verify before relying

• Whether Pysa's taint models cover your specific security concerns or require custom model writing.
• Performance characteristics when analyzing your specific codebase size and complexity.
• Integration workflow with existing CI/CD pipelines beyond the GitHub Action mentioned.

Package facts

Evidence: pyre_check-0.10.0-py3-none-macosx_11_0_arm64.whl; pyre_check-0.10.0-py3-none-manylinux1_x86_64.whl

Keywords: typechecker, development

Tags

More Software Development packages