Periodic Table

The software supply chain, laid out so position means something.

Twenty-five domains, 348 products, laid out in the order the chain runs. Open one to see its controls arranged by the program maturity each demands, how much of the modeled threat it closes, and who actually sells it.

Table

Capabilities Products

← All 25 domains

04Static Code Analysis

20 shown

Is every change to first-party code analyzed for exploitable vulnerabilities before merge, with findings accurate enough that developers act on them?

Color

Who maintains it Licensing Evaluation scores

Who maintains it

Foundation0
Community6
Company14

Bandit

Python Code Quality Authority (PyCQA) · Static Code Analysis

Close ×

Open SourceCommunity2.59 / 5

Bandit flags risky calls such as subprocess with shell, weak cryptography, hard-coded passwords and unsafe deserialization.

Repository ↗

What it does1 capability

0 of 1 at full coverage.

Static Application Security TestingPartialSAST · level 2 · 21 providers

What it proves16 controls across 11 frameworks

Satisfied through its capabilities, not claimed by the vendor.

SSDF 1.13 / 42PW.7.1 PW.7.2 RV.1.2
ASVS 5.02 / 17V1 V5
CSF 2.02 / 106ID.RA-01 PR.PS-06
SAMM 2.02 / 90V-ST-1-A V-ST-2-A
CIS Controls1 / 18CIS 16
CNAS Top 101 / 10CNAS-2
CRA1 / 41Annex I Part II (3)
DSOMM1 / 19TV-Static-Depth-Applications
OWASP Top 101 / 10A05:2025
SP 800-204D1 / 11204D-CI-COMMIT
Scorecard1 / 20SAST

What it stops2 techniques · 1 risk

2 techniques countered, 2 of them common

Exploit Public-Facing ApplicationT1190Very Common
Injection ExploitationVery Common

1 risks reduced

Exploitable flaw in first-party application codeHigh

Where it runs2 phases · 1 way to deploy

Capabilities per lifecycle phase

Code1
Build1

How it is delivered

CLI tool

What it unlocks2 activities · reaches level 2

Program activities its capabilities support, reaching level 2. Supporting an activity is not completing it.

Level 1

Run SAST on critical repositoriesLow effort

Level 2

Scan every pull request and block new high-confidence issuesLow effort

How it holds up11 criteria scored · 3 strengths · 4 limitations

Scored 0 to 5 against the evaluation criteria

Coverage from pre-commit to runtime2.5
Language, framework and ecosystem breadth1.2
Context-driven prioritization1.5
CI/CD and developer workflow integration3.2
APIs and extensibility3.0
Actionable remediation guidance2.2
Accuracy and noise2.8
Governance and compliance reporting1.5
AI capability maturity and AI security coverage1.0
Total cost and licensing fit5.0
Operational effort and skills required4.4

Strengths

Finds the Python mistakes that recur most often for nothing
Trivial to add as a pre-commit hook or a CI step
Well understood output that a Python developer reads without training

Limitations

One language so an estate of five languages needs five of these and a way to aggregate them
Pattern matching over the syntax tree with no data-flow so it misses anything requiring context
Known noisy on asserts and subprocess calls which teams routinely suppress wholesale
No triage prioritization reporting or ownership routing

Best for

Python-only codebases with no security budget
A baseline check beneath a commercial scanner

Differentiators

Free
Zero friction to adopt

What it costs2 tiers · Open source (free) · free tier

LicensingOpen source (free)

Priced pernone

BillingFree

Scales withOperating effort only

Open sourceFreeyear · Annual
Planning estimateestimateFreeyear · Annual

Total cost

No license cost, but self-support, upgrades, scaling and integration effort must be budgeted as personnel cost.

What it takes to run

No staffing, rollout time or operational commitment recorded.

What it works with1 language

Languages

Python

What else to look at

No alternative, competitor or family sibling is modeled for it.

What backs this up

No measurement, incident or pipeline using it.

Gantry 7.1.0 · OFF.12 · OFF.13

How this was produced

Every figure above was read from the Gantry knowledge graph, version 7.1.0, and computed when you opened this page — in 284 ms on 2026-10-27. Nothing here is a cached verdict or a dataset assembled for marketing: it is the same model our engagements run on.