Metadata-Version: 2.1
Name: pyre-check
Version: 0.10.0
Summary: A performant type checker and security-focused static analyzer for Python
Home-page: https://pyre-check.org/
Download-URL: https://github.com/facebook/Pysa
Author: Facebook
Author-email: pysa@meta.com
Maintainer: Facebook
Maintainer-email: pysa@meta.com
License: MIT
Keywords: typechecker development
Classifier: Development Status :: 5 - Production/Stable
Classifier: Environment :: Console
Classifier: Intended Audience :: Developers
Classifier: License :: OSI Approved :: MIT License
Classifier: Operating System :: MacOS
Classifier: Operating System :: POSIX :: Linux
Classifier: Programming Language :: Python
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.9
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Programming Language :: Python :: 3.14
Classifier: Topic :: Software Development
Classifier: Typing :: Typed
Requires-Python: >=3.9
Description-Content-Type: text/markdown
License-File: LICENSE
Requires-Dist: click (<8.2.0,>=8.0)
Requires-Dist: dataclasses-json (==0.5.7)
Requires-Dist: libcst
Requires-Dist: psutil
Requires-Dist: pyre-extensions (>=0.0.29)
Requires-Dist: tabulate
Requires-Dist: testslide (>=2.7.0)
Requires-Dist: typing-extensions
Requires-Dist: typing-inspect
Requires-Dist: tomli
Requires-Dist: tomli-w
Requires-Dist: pyrefly

[![tests](https://github.com/facebook/Pysa/actions/workflows/pysa.yml/badge.svg)](https://github.com/facebook/Pysa/actions/workflows/pysa.yml)
[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)

<p align="center">
  <img src="https://raw.githubusercontent.com/facebook/Pysa/main/logo.png">
</p>

Pysa is a security-focused static analysis tool for Python that tracks data flows to find security and privacy issues — for example, user-controlled input reaching a dangerous sink such as remote code execution or SQL injection. Pysa can analyze codebases with millions of lines of code. Refer to our [documentation](https://pyre-check.org/docs/pysa-basics) to get started.

Pysa relies on type information from [Pyrefly](https://pyrefly.org/), Meta's performant Python type checker.

Pysa is also available on the [GitHub Marketplace as a GitHub Action](https://github.com/marketplace/actions/pysa-action).

## Installation
Pysa requires Python 3.9 or later. Install it with pip:
```bash
$ pip install pyre-check
```
Pysa is currently distributed as part of the `pyre-check` package, since it was historically bundled with [Pyre](https://pyre-check.org/), Meta's (deprecated) type checker. In the future, Pysa will ship as its own PyPI package.

## Running Pysa
Pysa relies on type information from [Pyrefly](https://pyrefly.org/). Before running Pysa, make sure Pyrefly can successfully check your code:
```bash
$ pyrefly check
```
Once Pyrefly runs cleanly, run Pysa from your project directory to find security and privacy issues:
```bash
$ pyre analyze
```
Pysa uses models to identify sources of taint (where untrusted data enters) and sinks (dangerous operations). For details on configuring Pysa, writing models, and interpreting results, see the [Pysa documentation](https://pyre-check.org/docs/pysa-basics).

## Join the Pysa community

See [CONTRIBUTING.md](CONTRIBUTING.md) for how to help out.

## License

Pysa is licensed under the MIT license.
