{"id":5198,"library":"dodgy","title":"Dodgy: Python Code Linter for Sensitive Information","description":"Dodgy is a basic static analysis tool designed to scan Python codebases for 'dodgy' looking values. It uses simple regular expressions to detect patterns such as accidentally committed SCM diffs, hardcoded passwords, or secret keys. While initially developed for open-source projects to prevent public exposure of sensitive data, it can also be used in private projects, though its configurability is limited. The project appears to be inactive since its last release in 2019.","status":"abandoned","version":"0.2.1","language":"python","source_language":"en","source_url":"https://github.com/landscapeio/dodgy","tags":["linter","static analysis","code quality","security","secrets detection"],"install":[{"cmd":"pip install dodgy","lang":"bash","label":"Install with pip"}],"dependencies":[],"imports":[],"quickstart":{"code":"dodgy /path/to/your/project","lang":"bash","description":"Run Dodgy from the command line against your project directory to scan for problematic patterns. It's often recommended to integrate this as a pre-commit hook."},"warnings":[{"fix":"Consider using more actively maintained static analysis tools for sensitive data detection, such as 'bandit' or custom regular expression-based linters.","message":"The `dodgy` project is officially marked as 'Inactive' on PyPI, with its last release in December 2019. This means it is unlikely to receive updates, bug fixes, or new feature development, potentially leading to compatibility issues with newer Python versions or false positives/negatives.","severity":"breaking","affected_versions":"<=0.2.1"},{"fix":"Test thoroughly if using with newer Python versions, or consider migrating to a more modern tool. The `prospector` tool (which used to integrate `dodgy`) might offer a more up-to-date solution.","message":"PyPI classifiers indicate support up to Python 3.6. Running `dodgy` on Python versions 3.7+ may lead to unexpected behavior or errors due to lack of compatibility updates.","severity":"gotcha","affected_versions":">=0.2.1 (Python 3.7+)"},{"fix":"Always verify the package name, author, and version on PyPI before installation. Cross-reference with the official GitHub repository (github.com/landscapeio/dodgy) to confirm authenticity.","message":"The name 'dodgy' has been associated with various malicious packages on PyPI, leveraging typosquatting or other techniques to trick users into installing malware. Ensure you are installing the legitimate `dodgy` package from `landscapeio` (version 0.2.1) and not a similarly named malicious variant.","severity":"gotcha","affected_versions":"All versions"},{"fix":"Understand that `dodgy` is a basic tool. Supplement its use with manual code reviews or more sophisticated, configurable secrets detection tools that allow for custom rule sets and exclusions.","message":"The tool's configurability is noted in its README as 'not configurable enough currently to change that,' referring to its output often pointing out things that are not problems for private projects. This can lead to a high number of false positives in certain contexts.","severity":"gotcha","affected_versions":"All versions"}],"env_vars":null,"search_vec":"'2019':82 'accident':34 'also':60 'analysi':13,85 'appear':73 'basic':11 'code':3,86 'codebas':19 'commit':35 'configur':68 'data':57 'design':15 'detect':30,90 'develop':45 'diff':37 'dodgi':1,8,21 'exposur':54 'express':28 'hardcod':38 'inact':76 'inform':7 'initi':44 'key':42 'last':79 'limit':70 'linter':4,83 'look':22 'open':48 'open-sourc':47 'password':39 'pattern':31 'prevent':52 'privat':64 'project':50,65,72 'public':53 'python':2,18 'qualiti':87 'regular':27 'releas':80 'scan':17 'scm':36 'secret':41,89 'secur':88 'sensit':6,56 'simpl':26 'sinc':77 'sourc':49 'static':12,84 'though':66 'tool':14 'use':25,62 'valu':23","created_at":"2026-04-14T01:23:27.801291+00:00","updated_at":"2026-04-16T14:40:24.093325+00:00","problems":[{"fix":"Install the package using `pip install dodgy` and ensure you are running your script in the correct Python environment.","cause":"The 'dodgy' library is not installed in the Python environment being used, or there is a typo in the import statement.","error":"ModuleNotFoundError: No module named 'dodgy'"},{"fix":"Ensure that the directory where pip installs scripts (e.g., `~/.local/bin` on Linux/macOS or `Scripts` folder within your Python installation on Windows) is added to your system's PATH. Alternatively, you can run it using `python -m dodgy` from your terminal.","cause":"The 'dodgy' command-line executable, installed by pip, is not located in your system's PATH environment variable, or the pip installation directory for scripts is not in PATH.","error":"dodgy: command not found"},{"fix":"Verify the exact name and path of the component you wish to import by consulting the library's source code or documentation (if available). For general use, simply `import dodgy` may be sufficient, or you may not need to import specific internal components for its command-line functionality.","cause":"You are attempting to import a specific function, class, or submodule 'X' from the 'dodgy' package, but 'X' either does not exist, is not directly exposed at the top level of the package, or its name has changed. This can also occur if there's a circular import or naming conflict.","error":"ImportError: cannot import name 'X' from 'dodgy'"},{"fix":"Review the available public API of the 'dodgy' module (e.g., by using `dir(dodgy)` after importing it, or by examining the source code) to ensure you are calling an existing and intended function or attribute. The library is primarily a command-line tool, so direct programmatic access to all internal functions may not be supported or documented.","cause":"You have successfully imported the 'dodgy' module, but are attempting to call an attribute or function 'Y' that does not exist or is not publicly exposed on the module object.","error":"AttributeError: module 'dodgy' has no attribute 'Y'"}],"ecosystem":"pypi","meta_description":null,"install_score":null,"quickstart_score":null,"quickstart_tag":null,"pypi_latest":null,"cli_name":"dodgy","cli_version":"{","type":"library","homepage":null,"github":"https://github.com/landscapeio/dodgy","docs":null,"changelog":null,"pypi":"https://pypi.org/project/dodgy/","npm":null,"openapi_spec":null,"status_page":null,"smithery":null,"categories":["testing"],"base_url":null,"auth_type":null,"provenance":{"verified_status":null,"verified_at":null,"last_verified":"2026-04-13","next_check":"2026-07-12","install_tag":null}}