search

PyCQA / bandit

Bandit is a tool designed to find common security issues in Python code.
https://bandit.readthedocs.io
Apache License 2.0
6.51k stars 612 forks source link

OSSFuzz Integration #1079

Closed capuanob closed 10 months ago

capuanob commented 11 months ago

Good evening,

I am looking to integrate bandit into OSSFuzz. If you are not familiar with OSSFuzz, it is Google's platform for continuous fuzzing of open-source software. In order to get the most out of this program, it would be greatly beneficial to be able to merge in my fuzz harness and build scripts into the upstream repository and contribute bug fixes if they come up. Is this something that you would support me putting the effort into?

Thank you in advance!

ericwb commented 10 months ago

I suggest any OSSFuzz code kept in a separate repo from Bandit. I don't know the exact details of this integration, but I don't see much overlap in these two tools. That being said, Bandit has a plugin model using Stevedore.