This page's audience our own tag's counts — open to see them

Period

–Visits

–Page views

–Clicks to vendors

–Time on page

–Reading now

Clicks to vendors, by tool

Top countries

Devices

– · visits, page views and clicks counted by our own tag, which counts more than our checked analytics; every figure rounded down · how we count

Pysa

Free#20 of 25 in Static Application Security Testing Software

Pysa: A focused choice for Python teams that need customizable taint-flow analysis. Ranked #20 of 25 in Static Application Security Testing Software by our editors (6.8/10); pricing: Open source; best for python teams needing custom taint modeling.

6.8/10Editor score

Visit Pysa

Pysa6.8 Visit Pysa

At a glance

Editor score
6.8 / 10
Pricing
Open source
Best for
Python teams needing custom taint modeling
Paid from
Free
Analysis target
Source
Facts checked
22 Sep 2026

Where it wins
- Detailed source-to-sink taint-flow traces for Python code
- Custom models, rules, sanitizers, sources, and sinks
- JSON export with GitHub Actions and VS Code support
Where it doesn't
- Focused on Python rather than multiple programming languages
- Self-hosted deployment requires local environment management
- Packaging and maintenance direction may change with Pyre's deprecation

Our verdict on Pysa

Pysa is an open-source static application security testing tool for Python applications. It follows tainted data from defined sources to security sinks, helping teams investigate flows associated with issues such as remote code execution, SQL injection, and privacy concerns. Its audience is Python development and security teams that want source-code analysis with control over how application-specific data flows are modeled. Pysa runs on Linux and macOS, uses self-hosted deployment, and is distributed as part of the pyre-check package.

Its strongest capability is the depth of its taint-analysis model. Teams can define custom models in .pysa files and configure sources, sinks, rules, and features in taint.config. Sanitizers can remove or limit taint, while included models cover built-in and common Python libraries. Findings include source and sink trace information, and detailed results can be exported as JSON for further investigation. Supporting tools also provide interactive taint-model exploration, giving experienced users a way to examine and refine analysis behavior.

Pysa fits workflows that already use GitHub Actions or Visual Studio Code, with published support for both continuous integration and IDE use. The trade-off is its narrow focus: the category specification lists one supported language, Python, so teams with polyglot application portfolios may need another tool alongside it. Its packaging also deserves attention because Pysa is currently distributed through pyre-check and the official repository describes Pyre as deprecated. Choose Pysa when customizable Python taint-flow analysis is the priority; choose a broader alternative when language coverage or a more settled packaging direction matters more.

Your product? Our editors can test Pysa in depth and publish a review, labelled as paid · from $149/mo →

Pysa pricing

Plans Open sourceFree Free to use — no paid tier required for the core job.

See plans on pyre-check.org

Pysa fact sheet

Free plan	Not verified
Paid from	Free
Analysis target	Source
Supported languages	Not verified
IDE support	Not verified
CI/CD support	Yes
Deployment	Self-hosted
SCA included	Not verified
Fix guidance	Not verified
Deployment	Self-hosted
Platforms	macOS, Linux
Support	Docs
Built for	Small business, Mid-market, Enterprise (editorial estimate)
Integrations	3 integrations: GitHub Actions, SAPP, Pyrefly
Pricing	Open source
Website	pyre-check.org
Facts checked	22 Sep 2026

Pysa integrations

Pysa lists 3 integrations on its own site.

GitHub Actions
SAPP
Pyrefly

Alternatives to Pysa

See all Pysa alternatives →

Used Pysa? Be the first to review it

The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used Pysa for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.

Write a reviewTwo minutes · verified accounts only · read by an editor before it appears

Reviews come only from verified accounts. Sign in or create an account first — your e-mail is never shown.

Title

Your review

0 characters · at least 80, up to 3,000

Pros (optional · one per line)

Cons (optional · one per line)

Your name (shown with your review)

Role (optional)

Company (optional)

How long have you used it?

I've used Pysa myself and this is my honest opinion — nobody paid or asked me to write it.

Posted from your verified account. Reviews appear after an editor reads them, usually within two working days.

Featured on iTechGuides

Pysa is listed in our Static Application Security Testing Software directory. Add the badge to your site — it links back to this page.

<a href="https://www.itechguides.com/products/pysa/"><img src="https://www.itechguides.com/best/badge/pysa.svg" alt="Featured on iTechGuides" width="230" height="46"></a>

Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026

Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.

Last updated 7 Oct 2026 · How we research and update