Facebook open-sources Pysa – A Tool To Detect & Fix Security Issues In Python Code

guest · Aug 9, 2020

Facebook open-sources one of Instagram's security tools
In the first half of 2020, Pysa detected 44% of all security bugs in Instagram's server-side Python code
August 7, 2020
https://www.zdnet.com/article/facebook-open-sources-one-of-instagrams-security-tools/

Facebook has formally launched today one of Instagram's secret tools for finding and fixing bugs in the app's vast Python codebase.

Named Pysa, the tool is a so-called static analyzer. It works by scanning code in a "static" form, before the code is run/compiled, looking for known patterns that may indicate a bug, and then flagging potential issues with the developer.
DEVELOPED FOR SECURITY TEAMS
Behind this success stands the work of the Facebook security team. Even though Pysa was based on the open-source code of the Pyre project, the tool has been built around the needs of a security team.
Click to expand...

While most static analyzers look for a wide range of bugs, Pysa was specifically developed to look for security-related issues.

"Because we use open source Python server frameworks such as Django and Tornado for our own products, Pysa can start finding security issues in projects using these frameworks from the first run," Bleaney said.
Facebook has formally open-sourced Pysa on GitHub today, along with several bug definitions required to help it find security issues. The Zulip server project has already embedded Pysa in their codebase after the tool was used to discover a major security issue last year.
Click to expand...

Facebook: Pysa: An open source static analysis tool to detect and prevent security issues in Python code

Today, we are sharing details about Pysa, an open source static analysis tool we’ve built to detect and prevent security and privacy issues in Python code.

Last year, we shared how we built Zoncolan, a static analysis tool that helps us analyze more than 100 million lines of Hack code and has helped engineers prevent thousands of potential security issues. That success inspired us to develop Pysa, which is an acronym for Python Static Analyzer.
Click to expand...

Log in or Sign up

Facebook open-sources Pysa – A Tool To Detect & Fix Security Issues In Python Code

guest Guest

Log in or Sign up

Facebook open-sources Pysa – A Tool To Detect & Fix Security Issues In Python Code

guest Guest

Useful Searches