No. 12 of 25 ·Static Application Security Testing Software

Pysa

Windows · Mac · Linux · Extension

Freedom report

Two barsScore 5.5

Free tierNo free tier on record
Open codeNo open-source code on record
Runs widely3 of 6 device platforms
DocumentedPlans, terms and facts published

Pysa is ranked #12 of 25 in static application security testing software on Freedom251. It runs on Browser extension, Linux, macOS, Windows.

Compared on static application security testing software

Analysis target: source
CI/CD support: Yes
Deployment: self-hosted

Best Pysa alternatives

See all 12

Two bars Skylos Free tier No. 1Free6.7 Two bars Snyk Open Source Free tier No. 2$25/mo6.7 Two bars Horusec Free tier No. 3Free6.6 Two bars Puma Scan Free tier No. 4$24.92/mo6.6 Two bars Semgrep Code Free tier No. 5$30/mo6.6 Two bars Flawfinder Free tier No. 6Free6.5

The record

Purpose: Pysa is a Python static analysis tool that uses taint analysis to identify potential security issues.
Data flow analysis: Pysa tracks data from sources to dangerous sinks, such as user-controlled request data reaching an eval call.
Models and rules: Users configure sources, sinks, features, and rules in taint.config and annotate code with .pysa model files.
Built-in coverage: Pysa includes prewritten models and rules for built-in and common Python libraries.
Sanitizers: Pysa models sanitizers that remove taint from data, including annotations for sanitizing return values and parameters.
Installation: The quickstart installs Pysa with pip install pyre-check in a Python virtual environment.
Platforms: The installation page recommends its PyPI binary distribution for macOS and Linux; it says Windows use via WSL has worked but is not officially supported.
Editor integration: Pyre supports the Language Server Protocol and provides a VSCode extension that connects to a running server.
Results workflow: The quickstart uses SAPP to ingest Pysa results and provides a web UI for viewing and filtering issues.
Analysis scope: Pysa analyzes code in the target repository and directories listed in the configuration search_path; it does not see dependency source code otherwise.
Known limitation: When Pysa encounters a function whose source it cannot access, it assumes the function's return value has the same taint, which can cause false positives.
Resource needs: The quickstart says Pysa may freeze during analysis on projects of similar size when the machine does not have enough memory.
License: The Pysa repository states that Pysa is licensed under the MIT license.
Maintenance status: The Pyre repository says it was archived on June 26, 2026, and that Pysa moved to its own repository.

Where it ranks on Freedom251

Best Static Application Security Testing Software in 2026#12 of 25

Is Pysa yours?

Claim it for free: prove the domain, then correct facts, plans and screenshots. An editor reviews every change.

Claim it free Promote Pysa

Sources

pyre-check.org/docs/pysa-basics/· checked 4 Oct 2026
pyre-check.org/docs/pysa-quickstart/· checked 4 Oct 2026
pyre-check.org/docs/installation/· checked 4 Oct 2026
github.com/facebook/Pysa· checked 4 Oct 2026
github.com/facebook/pyre-check· checked 4 Oct 2026