In "An Empirical Study on Static Application Security Testing (SAST) Tools for Python", we present a dataset designed for evaluating Python SAST Tools.
This dataset consists of 108 unique Common Vulnerabilities and Exposures (CVEs), providing a valuable resource for benchmarking.
Using this dataset, we conducted a large scale empirical evaluation of eight state-of-the-art Python SAST Tools, examining their effectiveness and efficiency.
See “RealworldDataset.csv” and "SyntheticDataset.csv" in this repository.
SyntheticDataset is available now.
Due to size limit of GitHub, the RealworldDataset has been uploaded to https://zenodo.org/records/17936545
Using instructions will be released soon.
Initial set of tools could be found in "SAST Tools.csv"
| Stars | Version | |
|---|---|---|
| DevSkim | 950 | 1.0.59 |
| Dlint | 167 | 0.16.0 |
| Bandit | 6.7k | 1.8.0 |
| Bearer | 2.3k | 1.49.0 |
| CodeQL | 7.9k | 2.20.0 |
| Pysa | 6.9k | 0.9.23 |
| Semgrep | 10.9k | 1.101.0 |
| Snyk | 5k | 1.1293.1 |