You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Improve README structure, formatting, and installation clarity. #14 (#26)
## Summary
This PR improves the PySpector README by fixing markdown rendering
issues, clarifying installation steps (especially for Windows),
improving navigation with a table of contents, and enhancing overall
readability.
## Changes Made
- Fixed broken markdown and code block formatting
- Improved Python version and installation clarity
- Cleaned up Windows PowerShell setup instructions
- Added navigation structure and minor wording improvements
## Notes
No functional or behavioral changes were made. Documentation-only
improvements.
Closes#14
---------
Co-authored-by: RISHIKA-A-S <sjit.rishika@gmail.com>
Co-authored-by: Tommaso Bona <piergeolo@gmail.com>
PySpector is a static analysis security testing (SAST) Framework engineered for modern Python development workflows. It leverages a powerful Rust core to deliver high-speed, accurate vulnerability scanning, wrapped in a developer-friendly Python CLI. By compiling the analysis engine to a native binary, PySpector avoids the performance overhead of traditional Python-based tools, making it an ideal choice for integration into CI/CD pipelines and local development environments where speed is critical.
16
+
PySpector is a Static Application Security Testing (SAST) framework for modern Python projects.
17
+
It combines a high-performance Rust analysis engine with a developer-friendly Python CLI to deliver fast and accurate vulnerability scanning.
18
+
19
+
By compiling the core analysis engine to a native binary, PySpector avoids the performance limitations of traditional Python-only tools. This makes it well-suited for CI/CD pipelines and local development environments where speed and scalability matter.
17
20
18
21
The tool is designed to be both comprehensive and intuitive, offering a multi-layered analysis approach that goes beyond simple pattern matching to understand the structure and data flow of your application.
-[Triaging and Baselining](#triaging-and-baselining-findings)
31
+
-[Automation and Integration](#automation-and-integration)
20
32
21
33
22
34
## Getting Started
23
35
24
36
### Prerequisites
25
37
26
-
-**Python**: Version 3.12 or lower (Python 3.9+ required).
27
-
-**Rust**: The Rust compiler (`rustc`) and Cargo package manager are required. You can easily install the **Rust toolchain** via [rustup](https://rustup.rs/) and verify your installation by running `cargo --version`.
38
+
-**Python**: Python 3.9 – 3.12 supported (Python 3.9 or newer, up to 3.12).
39
+
-**Rust**: The Rust compiler (`rustc`) and Cargo package manager are required. You can easily install the **Rust toolchain** via [rustup](https://rustup.rs/) and verify your installation by running `cargo --version`.
28
40
29
41
### Installation
30
42
31
-
1.**Create a Virtual Environment**: It is highly recommended to install PySpector in a dedicated Python3.12 venv.
43
+
It is **highly recommended** to install PySpector in a dedicated Python 3.12 venv.
44
+
45
+
#### Create a Virtual Environment:
46
+
47
+
-**Linux (Bash)**:
32
48
```bash
33
49
python3.12 -m venv venv
34
50
source venv/bin/activate
35
51
```
36
-
* In Windows, just download Python 3.12 from the Microsoft Store and run:
37
-
```powershell
52
+
53
+
- **Windows (PowerShell)**:
54
+
```powershell
55
+
# Download Python 3.12 from the Microsoft Store and run:
38
56
python3.12 -m venv venv
39
57
.\venv\Scripts\Activate.ps1
40
-
# or, depending on the Python3.12 installation source: .\venv\bin\Activate.ps1
41
-
```
42
-
43
-
With PySpector now officially on PyPI(🎉), installation is as simple as running:
58
+
# or, depending on the Python 3.12 installation source:
59
+
.\venv\bin\Activate.ps1
60
+
```
44
61
62
+
With PySpector now officially on PyPI🎉, installation is as simple as running:
45
63
```bash
46
64
pip install pyspector
47
65
```
@@ -50,11 +68,11 @@ pip install pyspector
50
68
51
69
***Multi-Layered Analysis Engine:** PySpector employs a sophisticated, multi-layered approach to detect a broad spectrum of vulnerabilities:
52
70
53
-
****Regex-Based Pattern Matching:** Scans all files forspecific patterns, ideal for identifying hardcoded secrets, insecure configurationsin Dockerfiles, and weak settings in framework files.
71
+
-**Regex-Based Pattern Matching:** Scans all files forspecific patterns, ideal for identifying hardcoded secrets, insecure configurationsin Dockerfiles, and weak settings in framework files.
54
72
55
-
****Abstract Syntax Tree (AST) Analysis:** For Python files, the tool parses the code into an AST to analyze its structure. This enables precise detection of vulnerabilities tied to code constructs, such as the use of eval(), insecure deserialization with pickle, or weak hashing algorithms.
73
+
-**Abstract Syntax Tree (AST) Analysis:** For Python files, the tool parses the code into an AST to analyze its structure. This enables precise detection of vulnerabilities tied to code constructs, such as the use of eval(), insecure deserialization with pickle, or weak hashing algorithms.
56
74
57
-
****Inter-procedural Taint Analysis:** The engine builds a comprehensive call graph of the entire application to perform taint analysis. It tracks the flow of data from input sources (like web requests) to dangerous sinks (like command execution functions), allowing it to identify complex injection vulnerabilities with high accuracy.
75
+
-**Inter-procedural Taint Analysis:** The engine builds a comprehensive call graph of the entire application to perform taint analysis. It tracks the flow of data from input sources (like web requests) to dangerous sinks (like command execution functions), allowing it to identify complex injection vulnerabilities with high accuracy.
58
76
59
77
***Comprehensive and Customizable Ruleset:** PySpector comes with 241 built-in rules that cover common vulnerabilities, including those from the OWASP Top 10. The rules are defined in a simple TOML format, making them easy to understand and extend.
PySpector ships with an extensible plugin architecture that lets you post-process findings, generate custom artefacts, or orchestrate follow-up actions after every scan. Plugins run in-process once the Rust core returns the final issue list, so they see exactly the same normalized data that drives the built-in reports.
0 commit comments