qaudit 1.0.0

Zero-dependency static analysis for Python and Java — security, code quality, coupling checks, and actionable fix recommendations in a single HTML report

qaudit

Zero-dependency static analysis for Python and Java. Security, code quality, and coupling checks — one command, one self-contained HTML report.

pip install qaudit
qaudit /path/to/your/project --exclude-tests --format html

---

What it does

qaudit scans your Python or Java codebase without installing any extra dependencies. It detects security vulnerabilities, code quality issues, and architectural coupling problems, then produces an HTML report with a score, grade, and prioritised fix recommendations ordered by impact.

qaudit v1.0.0  |  my-service/src  |  language: java
  [1/13] OWASP Top 10 checks … 3 findings
  [2/13] Hardcoded secrets scan … 1 findings
  ...
  Score: 74/100  Grade: C  HIGH:3  MEDIUM:8  LOW:12  INFO:1
  Report written to: qaudit_report_my-service.html

---

Install

pip install qaudit

Requires Python 3.9+. No other dependencies.

---

Quick start

# Scan current directory
qaudit .

# Scan a project, exclude test files
qaudit ~/projects/my-app --exclude-tests

# Save report to a specific path
qaudit ~/projects/my-app --output reports/audit.html

# CI pipeline — SARIF output for GitHub Advanced Security
qaudit . --exclude-tests --format sarif --output qaudit.sarif

# JSON output for custom tooling
qaudit . --format json --output findings.json

---

CLI options

qaudit <project> [options]

Positional:
  project                   Path to the project directory to audit

Output:
  -o, --output FILE         Output file path
                            Default: qaudit_report_<project>.html
  -f, --format FORMAT       Output format: html | sarif | json
                              html   — self-contained report with score, findings,
                                       and prioritised fix recommendations (default)
                              sarif  — SARIF 2.1.0 for GitHub Advanced Security,
                                       VS Code SARIF Viewer, Azure DevOps
                              json   — machine-readable flat dump of all findings

Scan control:
  -l, --language LANG       Force language: python | java | auto
                            Default: auto (detects from file extensions)
  --exclude-tests           Skip test files from the scan
                            Excludes: tests/, test/, integration/, e2e/, spec/
                            directories and test_*.py / *_test.py /
                            *Test.java / *IT.java files
  -q, --quiet               Suppress progress output

Meta:
  --version                 Print version and exit

---

What it checks

97 checks across 10 categories — covering Python and Java, with framework-specific rules for FastAPI, PySpark, and Spring Boot.

Category	Languages	Checks
OWASP Top 10	Python, Java	35
Cryptography	Python, Java	18
Code quality & coupling	Python, Java	17
Language standards	Python, Java	30
Framework checks	FastAPI, PySpark, Spring Boot	19
Security extras	Python, Java	4
Advanced / async	Python, Java	4
Config file audit	Dockerfile, properties, YAML, .env	included
Taint analysis	Python	included
ReDoS & PII detection	Python, Java	included

All findings include a severity (HIGH / MEDIUM / LOW / INFO), file location, and a fix suggestion. The HTML report groups findings by file, supports filtering by severity, and includes a coupling analysis tab.

---

Score and grades

qaudit uses a two-pillar scoring model:

Pillar	Weight	What it covers
Security	60 pts	OWASP, secrets, taint, config
Quality	40 pts	Code structure, coupling, standards

Grade	Score	Meaning
A	90–100	Enterprise-clean
B	80–89	Good — minor quality debt
C	70–79	Acceptable — a few MEDIUM issues
D	60–69	Marginal — multiple MEDIUM or 1–2 HIGH findings
F	< 60	Failing — HIGH findings or heavy technical debt

The HTML report includes a Fix Recommendations section showing which checks to fix first for maximum score gain, with effort estimates (Low / Medium / High) per fix.

---

Exit codes

Code	Meaning
0	No HIGH or MEDIUM findings — CI pipeline passes
1	At least one HIGH or MEDIUM finding — CI pipeline fails
2	Usage error (invalid path, unknown option)

Use exit code 1 to gate pull request merges in CI:

# GitHub Actions example
- name: Run qaudit
  run: qaudit src/ --exclude-tests --format sarif --output qaudit.sarif
- name: Upload SARIF
  uses: github/codeql-action/upload-sarif@v3
  with:
    sarif_file: qaudit.sarif

---

Suppressing false positives

Add an inline comment on the offending line with the check ID:

# Python
result = open(path)  # qaudit: ignore CQ-PY-002

# Suppress all checks on a line
some_call()  # qaudit: ignore

# Suppress multiple checks
some_call()  # qaudit: ignore CQ-PY-002, PS-PY-004

// Java
System.out.println(x);  // qaudit: ignore CQ-JV-002

All suppressed lines are listed in the Suppression Audit section of the HTML report so they remain visible to reviewers and are not silently buried.

---

Output formats

HTML (default)

Self-contained single-file report — no external assets, works offline. Includes:

• Score gauge and grade
• Finding table with severity, file, line, description, and fix suggestion
• Fix Recommendations panel ordered by score impact
• Suppression Audit section

SARIF

SARIF 2.1.0 — compatible with:

• GitHub Advanced Security (Code Scanning)
• VS Code SARIF Viewer extension
• Azure DevOps

JSON

Flat array of findings for custom dashboards, ticketing integrations, or trend tracking.

---

Supported languages and frameworks

Language	Version
Python	3.9+
Java	8–21
Spring Boot	2.x, 3.x
FastAPI	0.90+
PySpark	3.x

---

License

MIT