Security linter for Python code
Static analyser from the PyCQA that builds an AST of each Python file and runs plugins to flag common security issues.
Bandit parses Python source into an abstract syntax tree and runs a set of plugins against it, flagging issues such as use of insecure functions, weak cryptography, hard-coded passwords and unsafe deserialisation. Findings come with a severity and a confidence level.
It is maintained by the Python Code Quality Authority and is easy to drop into pre-commit hooks and CI pipelines.
Apache-2.0 · Apache License 2.0 · Open source
Checked by ThreatWire against the repository's licence file on 2026-10-20. GitHub detects: Apache-2.0.
No published advisory found for Bandit in GitHub repository advisories and OSV.dev. That does not mean the tool has no vulnerabilities.
Sources: GitHub repository advisories, OSV.dev · checked 2026-10-20.
Lightweight, pattern-based static analysis
Fast static analysis engine where rules look like the code they match, supporting many languages; the open-source Community Edition runs locally and in CI.
Security checker for Go source code
Inspects Go source code through its AST and SSA representation to find security problems such as injection, weak crypto and unsafe file handling.
Static analyser for Solidity and Vyper
Trail of Bits' static analysis framework for Solidity and Vyper with dozens of vulnerability detectors, printers and an API for custom analyses.
Rust-based Solidity static analyser
Cyfrin's static analyser for Solidity written in Rust, with detectors, Markdown audit-style reports and editor integration.
