Skip to content

Commit f4ec9e1

Browse files
authored
1 parent 093a077 commit f4ec9e1

File tree

1 file changed

+3
-0
lines changed

1 file changed

+3
-0
lines changed

Diff for: README.rst

+3
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,8 @@
2222
This project is no longer maintained
2323
====================================
2424

25+
**March 2020 Update**: Please go see the amazing `Pysa tutorial`_ that should get you up to speed finding security vulnerabilities in your Python codebase.
26+
2527
`Pyre`_ from Facebook is an amazing project that has a bright future and many smart people working on it.
2628
I would suggest, if you don't know that much about program analysis, that you understand how PyT works before diving into Pyre. Along with the `README's in most directories`_, there are the original `Master's Thesis`_ and `some slides`_.
2729
With that said, **I am happy to review pull requests and give you write permissions if you make more than a few.**
@@ -30,6 +32,7 @@ There were a lot of great contributors to this project, I plan on working on oth
3032

3133
If you are a security engineer with e.g. a Python codebase without type annotations, that Pyre won't handle, I would suggest you replace your sinks with a secure wrapper (something like `defusedxml`_), and alert off any uses of the standard sink. You can use `Bandit`_ to do this since dataflow analysis is not required, but you will have to trim it a lot, due to the high false-positive rate.
3234

35+
.. _Pysa tutorial: https://github.com/facebook/pyre-check/tree/master/pysa_tutorial#pysa-tutorial
3336
.. _Pyre: https://github.com/facebook/pyre-check
3437
.. _README's in most directories: https://github.com/python-security/pyt/tree/master/pyt#how-it-works
3538
.. _Master's Thesis: https://projekter.aau.dk/projekter/files/239563289/final.pdf

0 commit comments

Comments
 (0)