codeaudit 1.8.1__tar.gz → 1.9.1__tar.gz

codeaudit-1.9.1/.github/workflows/python-test.yml

@@ -0,0 +1,31 @@
+name: Python Package Test
+
+on:
+  push:
+    paths:
+      - 'src/**'
+      - 'tests/**'
+  pull_request:
+    paths:
+      - 'src/**'
+      - 'tests/**'
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+
+    steps:      
+      - uses: actions/checkout@v5
+
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@v6        
+        with:
+          python-version: 3.14
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip hatch
+
+      - name: Test with hatch
+        run: |
+          hatch test -acr

codeaudit-1.9.1/.github/workflows/sast_validation.yml

@@ -0,0 +1,45 @@
+# SAST scan with Python Code Audit on GitHub Actions 
+# Uses the development version!! So make sure it always works -)
+
+name: Python Code Audit SAST Scan
+
+on:
+  push:
+    paths:
+      - 'src/**'
+  pull_request:
+    paths:
+      - 'src/**'
+
+jobs:
+  codeaudit-scan:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v5
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.14"
+
+      - name: Upgrade pip
+        run: python -m pip install --upgrade pip
+
+      - name: Install Python Code Audit
+        run: python -m pip install -e .
+
+      - name: Show version
+        run: codeaudit --version
+
+      - name: Run SAST scan
+        run: |
+          codeaudit cimode . --output text | tee codeaudit-output.text
+          exit ${PIPESTATUS[0]}
+
+      - name: Upload scan artifact
+        uses: actions/upload-artifact@v6
+        with:
+          name: codeaudit-${{ github.ref_name }}
+          path: codeaudit-output.text

{codeaudit-1.8.1 → codeaudit-1.9.1}/CHANGELOG.md

@@ -1,5 +1,51 @@
 # Change Log
 
+## Version 1.9.1:
+
+**Added**
+
+* Extra badge in the `README.md` for direct launch of the WASM version.
+* A switch option in the UI for the WASM version to use or suppress markers in code when scanning.
+* AI policy section for contributions in the manual.
+
+**Changed**
+
+* Adjusted validation values for checking `targz` files (`max_file_size = 15 * 1024 * 1024`, `max_tar_members = 12000`).
+* Tightened security for validating Python files using `validate_python` from the `fileaudit` Python module.
+* Dashboard version: Improved validation for valid PyPI names on the client side.
+* Improved handling and status of tabs in the WASM version.
+* Minor updates to the CLI help text.
+* Changed the manual title from **Python Security Code Audit** to **Python Code Audit**.
+
+**Fixed**
+
+* Improved and updated unit tests for validating the correct working of excluded directories during scans (`test_excluded_dirs`).
+
+**Documentation**
+
+* General updates and fixes for the manual.
+
+
+## Version 1.9.0:
+
+**Added**
+
+* Support for scanning local and remote `.tar.gz` files using the `filescan` API function, simplifying package scanning before PyPI publication (available via `codeaudit filescan` and `codeaudit overview` CLI commands).
+* Added `"test"` to the default collection of excluded scan directories.
+
+**Changed**
+
+* Improved the `filescan` API function.
+* Dropped active installation support for Python versions older than 3.12 (code analysis support for older Python versions remains available).
+* Updated GitHub Actions to use Node.js 24.
+* Optimized the GitHub testing workflow to ignore documentation-only changes.
+
+
+**Documentation**
+
+* Updated and improved unit tests to reflect current functionality and test coverage.
+
+
 ## Version 1.8.1:
 
 **Added**

{codeaudit-1.8.1 → codeaudit-1.9.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codeaudit
-Version: 1.8.1
+Version: 1.9.1
 Summary: A modern Python security source code analyzer (SAST) based on distrust.
 Project-URL: Homepage, https://codeaudit.nocomplexity.com
 Project-URL: Documentation, https://github.com/nocomplexity/codeaudit#readme
@@ -15,14 +15,14 @@ Classifier: Environment :: Console
 Classifier: Intended Audience :: Developers
 Classifier: Intended Audience :: Science/Research
 Classifier: Programming Language :: Python
-Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
 Classifier: Programming Language :: Python :: 3.14
 Classifier: Topic :: Security
 Classifier: Topic :: Software Development :: Quality Assurance
-Requires-Python: >=3.11
+Requires-Python: >=3.12
 Requires-Dist: altair==6.0.0
+Requires-Dist: fileaudit
 Requires-Dist: fire==0.7.1
 Requires-Dist: pandas>=2.3
 Provides-Extra: test
@@ -35,7 +35,7 @@ Description-Content-Type: text/markdown
 
 # Codeaudit
 
-![CodeauditLogo](https://github.com/nocomplexity/codeaudit/raw/main/docs/images/codeauditlogo.png)
+[![CodeauditLogo](https://github.com/nocomplexity/codeaudit/raw/main/docs/images/codeauditlogo.png)](https://codeaudit.nocomplexity.com/)
 
 [![PythonCodeAudit Badge](https://img.shields.io/badge/Python%20Code%20Audit-Security%20Verified-FF0000?style=flat-square)](https://github.com/nocomplexity/codeaudit)
 [![PyPI - Version](https://img.shields.io/pypi/v/codeaudit.svg)](https://pypi.org/project/codeaudit)
@@ -43,6 +43,7 @@ Description-Content-Type: text/markdown
 [![OpenSSF Best Practices](https://www.bestpractices.dev/projects/10970/badge)](https://www.bestpractices.dev/projects/10970)
 [![Documentation](https://img.shields.io/badge/Python%20Code%20Audit%20Handbook-Available-blue)](https://nocomplexity.com/documents/codeaudit/intro.html)
 [![License](https://img.shields.io/badge/License-GPLv3-FFD700)](https://nocomplexity.com/documents/codeaudit/license.html)
+[![Try WebAssembly Version](https://img.shields.io/badge/Try_Live-In%20Your%20Browser-8A2BE2)](https://nocomplexity.com/codeauditapp/dashboardapp.html)
 [![PyPI Downloads](https://static.pepy.tech/badge/codeaudit)](https://pepy.tech/projects/codeaudit)
 
 Python Code Audit - A modern Python security source code analyzer based on distrust.
@@ -51,6 +52,15 @@ Python Code Audit is a static application security testing (SAST) tool designed
 
 This tool is designed for anyone who uses or creates Python programs and wants to understand and mitigate potential security risks.
 
+> [!TIP]
+> **Try it instantly — no installs, no setup, no excuses.**
+> 
+> 👉 [Launch the browser version](https://nocomplexity.com/codeauditapp/dashboardapp.html)
+
+It runs **100% locally** in your browser via WebAssembly (WASM). See the full power of **Python Code Audit** within 60 seconds.
+No downloads. No dependencies. Just click and run a security audit on any Python package on PyPI!
+
+
 This tool is created for:
 
 - Python Users who want to assess the security risks in the Python code they use.
@@ -82,14 +92,6 @@ Python Code Audit has the following features:
 
 ## Installation
 
-> [!TIP]
-> Try it instantly—no installs, no setup, no excuses.
->
-> 👉 Launch the browser version [here](https://nocomplexity.com/codeauditapp/dashboardapp.html)
-
-It runs 100% locally in your browser using WebAssembly (WASM). See the power of the tool in under 60 seconds.
-No downloads. No dependencies. Just click and do a security audit on Python Code.
-
 Loved the browser version? Unlock the full power. For advanced security code inspections, CI/CD integration, and all professional features, install the complete Python package:
 
 ```console

{codeaudit-1.8.1 → codeaudit-1.9.1}/README.md

@@ -1,6 +1,6 @@
 # Codeaudit
 
-![CodeauditLogo](https://github.com/nocomplexity/codeaudit/raw/main/docs/images/codeauditlogo.png)
+[![CodeauditLogo](https://github.com/nocomplexity/codeaudit/raw/main/docs/images/codeauditlogo.png)](https://codeaudit.nocomplexity.com/)
 
 [![PythonCodeAudit Badge](https://img.shields.io/badge/Python%20Code%20Audit-Security%20Verified-FF0000?style=flat-square)](https://github.com/nocomplexity/codeaudit)
 [![PyPI - Version](https://img.shields.io/pypi/v/codeaudit.svg)](https://pypi.org/project/codeaudit)
@@ -8,6 +8,7 @@
 [![OpenSSF Best Practices](https://www.bestpractices.dev/projects/10970/badge)](https://www.bestpractices.dev/projects/10970)
 [![Documentation](https://img.shields.io/badge/Python%20Code%20Audit%20Handbook-Available-blue)](https://nocomplexity.com/documents/codeaudit/intro.html)
 [![License](https://img.shields.io/badge/License-GPLv3-FFD700)](https://nocomplexity.com/documents/codeaudit/license.html)
+[![Try WebAssembly Version](https://img.shields.io/badge/Try_Live-In%20Your%20Browser-8A2BE2)](https://nocomplexity.com/codeauditapp/dashboardapp.html)
 [![PyPI Downloads](https://static.pepy.tech/badge/codeaudit)](https://pepy.tech/projects/codeaudit)
 
 Python Code Audit - A modern Python security source code analyzer based on distrust.
@@ -16,6 +17,15 @@ Python Code Audit is a static application security testing (SAST) tool designed
 
 This tool is designed for anyone who uses or creates Python programs and wants to understand and mitigate potential security risks.
 
+> [!TIP]
+> **Try it instantly — no installs, no setup, no excuses.**
+> 
+> 👉 [Launch the browser version](https://nocomplexity.com/codeauditapp/dashboardapp.html)
+
+It runs **100% locally** in your browser via WebAssembly (WASM). See the full power of **Python Code Audit** within 60 seconds.
+No downloads. No dependencies. Just click and run a security audit on any Python package on PyPI!
+
+
 This tool is created for:
 
 - Python Users who want to assess the security risks in the Python code they use.
@@ -47,14 +57,6 @@ Python Code Audit has the following features:
 
 ## Installation
 
-> [!TIP]
-> Try it instantly—no installs, no setup, no excuses.
->
-> 👉 Launch the browser version [here](https://nocomplexity.com/codeauditapp/dashboardapp.html)
-
-It runs 100% locally in your browser using WebAssembly (WASM). See the power of the tool in under 60 seconds.
-No downloads. No dependencies. Just click and do a security audit on Python Code.
-
 Loved the browser version? Unlock the full power. For advanced security code inspections, CI/CD integration, and all professional features, install the complete Python package:
 
 ```console

{codeaudit-1.8.1 → codeaudit-1.9.1}/SECURITY.md

@@ -20,7 +20,7 @@ I will send a response indicating the next steps in handling your report. After
 
 
 > [!TIP]
-> To learn more about security, please visit [Simplify Cyber Security](https://nocomplexity.com/simplify-security/). And do not hestite to join-in to make these Free and Open Security Playbooks better!
+> To learn more about security, please visit [Simplify Cyber Security](https://nocomplexity.com/simplify-security/). And do not hesitate to join-in to make these Free and Open Security Playbooks better!
 
 
 

{codeaudit-1.8.1 → codeaudit-1.9.1}/docs/CONTRIBUTE.md

@@ -63,6 +63,58 @@ See the [section Development](makeitbetter) for to get a head start when making
 
 :::
 
+(AI-policy)=
+## Generative AI / LLM Policy
+
+Everyone is free to make contributions with or without AI assistence. Especially since English is not the native language of many people and users.
+
+**BUT:** Due to both legal and human reasons, we have to establish boundaries.
+
+:::{caution}
+- We take the responsibility for this project very seriously and we expect you to take your responsibility for your contributions seriously, too.
+- Every contribution has to be backed by a human who unequivocally owns the copyright for all changes.
+
+No LLM bots in `Co-authored-by:`s.
+- Absolutely **no** unsupervised agentic tools like OpenClaw.
+
+By submitting a pull request, you declare that:
+- You are the author of the contribution.
+- You **understand** the code.
+- You accept full responsibility for it.
+:::
+
+### Legal
+
+When you contribute to **Python Code Audit** (On PyPI `codeaudit`), your contributions (with or without AI support) are made under the same license as the file you are working on. You retain your copyright to your changes to this project.
+
+
+### Human
+
+We take responsibility to our users very serious. Every code change is reviewed manually before merging because it's our responsibility to keep the project **stable and secure**.
+
+Please understand that by opening low-quality pull requests generated by AI you're not helping. Make small pull request that are easy to review and merge. 
+:::{note}
+Every pull request must be created by a Human or reviewed by a human. A human is responsible for all text in an issue or pull request. 
+:::
+
+We have no time to become part of your vibe coding loop where you drop LLM slop and we spend time and energy to review it, and you just feed it back into the LLM for another iteration.
+
+In practice, this means:
+
+- Pull requests that have an LLM product listed as co-author can't be merged and will be closed without further discussion.
+
+If you used LLM tools during development, you may still submit. But you must remove all LLM author tags and take full ownership of every line.
+
+- By submitting a pull request, **you** take full responsibility for the contents of the pull request.
+
+*"An LLM wrote it"* is **not** an acceptable response to questions or review remarks.
+
+So:
+- Do **not** post LLM-generated review comments.
+- Do **not** post summaries unless you've fact-checked them and take responsibility for 100% of their content.
+
+*Attribution: This AI policy is based on [attrs' AI_POLICY.md](https://github.com/python-attrs/attrs/blob/main/.github/AI_POLICY.md).*
+
 (CoC-label)=
 ## Code of Conduct
 

{codeaudit-1.8.1 → codeaudit-1.9.1}/docs/_config.yml

@@ -99,6 +99,6 @@ sphinx:
       use_issues_button: True       
       home_page_in_toc: True 
       logo:
-           text: <b>Python Security Code Audit</b>
+           text: <b>Python Code Audit</b>
       extra_footer: '<p><a rel="license" href="http://creativecommons.org/licenses/by-sa/4.0/"><img alt="Creative Commons License" style="border-width:0" src="https://i.creativecommons.org/l/by-sa/4.0/88x31.png" /></a> This work is licensed under a <a rel="license" href="http://creativecommons.org/licenses/by-sa/4.0/">Creative Commons Attribution-ShareAlike 4.0 International License</a>.</p>'
       

{codeaudit-1.8.1 → codeaudit-1.9.1}/docs/checks/exception_check.md

@@ -1,4 +1,4 @@
-## Exception Statements
+# Exception Statements
 
 Python Code Audit  detects the use of `pass` within an `except` block.
 

{codeaudit-1.8.1 → codeaudit-1.9.1}/docs/cimode.md

@@ -198,12 +198,12 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
-          python-version: "3.13"
+          python-version: "3.14"
 
       - name: Upgrade pip
         run: python -m pip install --upgrade pip
@@ -220,7 +220,7 @@ jobs:
           exit ${PIPESTATUS[0]}
 
       - name: Upload scan artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: codeaudit-${{ github.ref_name }}
           path: codeaudit-output.text
@@ -243,10 +243,10 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: "3.13"
 
@@ -263,7 +263,7 @@ jobs:
         run: codeaudit cimode . --output html > codeaudit-output.html
 
       - name: Upload scan artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         with:
           name: codeaudit-${{ github.ref_name }}
           path: codeaudit-output.html

{codeaudit-1.8.1 → codeaudit-1.9.1}/docs/codeauditcommands.md

@@ -1,6 +1,6 @@
 % THIS FILE IS GENERATED! - Use CLIcommands.ipynb to make it better!
 # Commands Overview
-Python Code Audit commands for: version: 1.8.1
+Python Code Audit commands for: version: 1.9.1
 ```
 ----------------------------------------------------
  _                    __             _
@@ -16,62 +16,88 @@ Usage: codeaudit COMMAND <directory|package>  [report.html]
 Depending on the command, you must specify a local directory, a Python file, or a package name hosted on PyPI.org.Reporting: The results are generated as a static HTML report for viewing in a web browser.
 
 Commands:
-  overview             Generates an overview report of code complexity and security indicators.
-  filescan             Scans Python source code or PyPI packages for security weaknesses.
+  overview             Generate an overview report of code complexity and security indicators.
+  filescan             Scan Python source code, PyPI packages, or tar.gz archives for security weaknesses.
   cimode               Run a SAST scan for CI workflows.
   modulescan           Generate a report on known vulnerabilities in Python modules and packages.
   checks               Creates an HTML report of all implemented security checks.
   version              Prints the module version. Or use codeaudit [-v] [--v] [-version] or [--version].
 
-Use the Python Code Audit documentation (https://codeaudit.nocomplexity.com) to audit and secure your Python programmes. Explore further essential open-source security tools at https://simplifysecurity.nocomplexity.com/
+Use the Python Code Audit documentation (https://codeaudit.nocomplexity.com) to audit and secure your Python programmes. Explore further essential open-source security tools at https://pythonsecurity.nocomplexity.com/
 
 ```
 ## codeaudit overview
 ```text
-Generates an overview report of code complexity and security indicators.
+Generate an overview report of code complexity and security indicators.
 
-This function analyzes a Python project to produce a high-level overview of
-complexity and security-related metrics. The input may be either:
+This function analyzes a Python project and generates a high-level HTML
+overview of code complexity, project size, module dependencies, and
+security-related indicators.
 
-- A local directory containing Python source files
-- The name of a package hosted on PyPI.org
+The input can be one of the following:
 
-So:
-codeaudit overview <package-name|directory> [reportname.html]
+* A local directory containing Python source files
+* A local or remote ``.tar.gz`` source archive
+* The name of a package hosted on PyPI.org
 
-For PyPI packages, the source distribution (sdist) is downloaded,
+codeaudit overview <package-name|directory|archive.tar.gz> [reportname.html]
+
+For a local or remote ``.tar.gz`` archive, the archive is validated,
+extracted to a temporary directory, scanned, and removed after the report
+has been generated.
+
+For a PyPI package, the source distribution (sdist) is downloaded,
 extracted to a temporary directory, scanned, and removed after the report
-is generated.
+has been generated.
+
+The report includes:
 
-The report includes summary statistics, security risk indicators based on
-complexity and total lines of code, a list of discovered modules, per-file
-metrics, and a visual overview. Results are written to a static HTML file.
+* Summary statistics for the analyzed project
+* Security concern indicators based on maximum code complexity
+  and total lines of code
+* A list of discovered standard-library and external modules
+* Detailed metrics for each Python source file
+* A visual overview of the collected metrics
+* Advice for performing a full SAST scan with ``codeaudit filescan``
 
 Examples:
     Generate an overview report for a local project directory::
 
         codeaudit overview /projects/mycolleaguesproject
 
+    Generate an overview report for a local ``.tar.gz`` archive::
+
+        codeaudit overview /path/to/myproject.tar.gz
+
+    Generate an overview report for a remote ``.tar.gz`` archive::
+
+        codeaudit overview https://example.com/myproject.tar.gz
+
     Generate an overview report for a PyPI package::
 
-        codeaudit overview linkaudit #A nice project on PyPI.org
+        codeaudit overview linkaudit
 
-        codeaudit overview pydantic  #A complex project on PyPI.org from a security perspective?
+        codeaudit overview pydantic
+
+    Specify an output report file::
+
+        codeaudit overview /projects/mycolleaguesproject report.html
 
 Args:
-    directory (str): Path to a local directory containing Python source files
-        or the name of a package available on PyPI.org.
+    directory (str): Path to a local directory containing Python source
+        files, a local or remote ``.tar.gz`` source archive, or the name of
+        a package available on PyPI.org.
     filename (str, optional): Name (and optional path) of the HTML file to
-        write the overview report to. The filename should use the ``.html``
-        extension. Defaults to ``DEFAULT_OUTPUT_FILE``.
+        write the overview report to. The filename should use the
+        ``.html`` extension. Defaults to ``DEFAULT_OUTPUT_FILE``.
 
 Returns:
-    None. The function writes a static HTML overview report to disk.
+    None: The function writes a static HTML overview report to disk.
 
 Raises:
-    SystemExit: If the provided path is not a directory, contains no Python
-        files, or is neither a valid local directory nor a valid PyPI
-        package name.
+    SystemExit: If the provided path is not a directory, contains no
+        Python files, is an invalid ``.tar.gz`` archive, or is neither a
+        valid local input nor a valid PyPI package name.
 str(object='') -> str
 str(bytes_or_buffer[, encoding[, errors]]) -> str
 
@@ -133,26 +159,32 @@ errors defaults to 'strict'.
 ```
 ## codeaudit filescan
 ```text
-Scans Python source code or PyPI packages for security weaknesses.
+Scan Python source code, PyPI packages, or tar.gz archives for security weaknesses.
+
 This function performs static application security testing (SAST) on a
 specified input. The input can be one of the following:
 
 * A local directory containing Python source code
 * A single local Python file
+* A local or remote ``.tar.gz`` source archive
 * The name of a package hosted on PyPI
 
-codeaudit filescan <pythonfile|package-name|directory> [reportname.html] [--nosec]
+codeaudit filescan <pythonfile|package-name|directory|archive.tar.gz> [reportname.html] [--nosec]
 
 Based on the input type, the function analyzes the source code for potential
 security issues, generates an HTML report summarizing the findings, and
 writes the report to disk.
 
+For a local or remote ``.tar.gz`` archive, the archive is validated,
+extracted to a temporary directory, scanned as a source directory, and
+cleaned up after the scan completes.
+
 If a PyPI package name is provided, the function downloads the source
 distribution (sdist), extracts it to a temporary directory, scans the
 extracted source code, and cleans up all temporary files after the scan
 completes.
 
- Examples:
+Examples:
 
     Scan a local directory and write the report to ``report.html``::
 
@@ -166,49 +198,56 @@ completes.
 
         codeaudit filescan myexample.py
 
+    Scan a local tar.gz archive::
+
+        codeaudit filescan /path/to/package.tar.gz
+
+    Scan a remote tar.gz archive::
+
+        codeaudit filescan https://example.com/package.tar.gz
+
     Scan a package hosted on PyPI::
 
         codeaudit filescan linkaudit
 
         codeaudit filescan requests
 
-
     Specify an output report file::
 
         codeaudit filescan /path/to/project report.html
 
-    Enable filtering of issues marked with ``#nosec`` or another marker on potential code weaknesses that mitigated or known  ::
+    Enable filtering of issues marked with ``#nosec`` or another marker
+    indicating that potential code weaknesses have been reviewed or
+    intentionally ignored::
 
         codeaudit filescan myexample.py --nosec
 
 POSITIONAL ARGUMENTS
 INPUT_PATH
-    Path to a local Python file or directory, or the name of a package available on PyPI.
-
+    Path to a local Python file or directory, a local or remote ``.tar.gz``
+    archive, or the name of a package available on PyPI.
 
 FLAGS
 -f, --filename=FILENAME
     Default: 'codeaudit-report.html'
--n, --nosec=NOSEC
-    Default: False
-
-
-Args:
+    Name (and optional path) of the HTML file to write the scan report to.
+    The filename should use the ``.html`` extension.
 
--f, --filename=FILENAME
-    Default: 'codeaudit-report.html'
-    Name (and optional path) of the HTML file to write the scan report to. The filename should use the ``.html`` extension. Defaults to ``DEFAULT_OUTPUT_FILE``.
 -n, --nosec=NOSEC
     Default: False
-    Whether to filter out issues marked as reviewed or ignored in the source code. Defaults to ``False``, no filtering.
+    Whether to filter out issues marked as reviewed or ignored in the
+    source code.
 
-    input_path (str): Path to a local Python file or directory, or the name
-        of a package available on PyPI.
+Args:
+    input_path (str): Path to a local Python file or directory, a local or
+        remote ``.tar.gz`` archive, or the name of a package available on
+        PyPI.
     filename (str, optional): Name (and optional path) of the HTML file to
         write the scan report to. The filename should use the ``.html``
         extension. Defaults to ``DEFAULT_OUTPUT_FILE``.
     nosec (bool, optional): Whether to filter out issues marked as reviewed
-        or ignored in the source code. Defaults to ``False``, no filtering.
+        or ignored in the source code. Defaults to ``False``, meaning no
+        filtering is applied.
 
 Returns:
     None: The function writes a static HTML security report to disk.

{codeaudit-1.8.1 → codeaudit-1.9.1}/docs/codeauditoverview.md

@@ -2,21 +2,28 @@
 # Command `codeaudit overview`
 
 
+Use this command to generate a quick security-relevant assessment of a Python project or package. It provides an overview of important security and code-complexity metrics for the project.
 
-Use this command to generate a quick security relevant assessment of a Python project or package. It provides an overview of important security metrics for the project.
+## Usage
 
-Usage
-```Bash
-codeaudit overview <package-path|package-name> [report-name.html]
+```bash
+codeaudit overview <package-path|package-name|package.tar.gz> [report-name.html]
 ```
 
-Arguments:
-* `<package-path|package-name>` (Required)
-Specify either a local directory containing Python files or the name of a Python package hosted on PyPI.org.
+## Arguments
+
+* `<package-path|package-name|package.tar.gz>` (Required)
+
+  Specify one of the following:
+
+  * A local directory containing Python files.
+  * The name of a Python package hosted on PyPI.org.
+  * A local `.tar.gz` source archive.
+  * A remote `.tar.gz` source archive URL (only HTTPS allowed!).
 
 * `[report-name.html]` (Optional)
-The filename for the generated security report. If omitted, the tool will use a default filename. If you provide a custom name, ensure it ends with the `.html` extension.
 
+  The filename for the generated overview report. If omitted, the tool will use a default filename. If you provide a custom name, ensure it ends with the `.html` extension.
 
 
 For every Python file the following **security** relevant statistics are determined:

{codeaudit-1.8.1 → codeaudit-1.9.1}/docs/examples/codeauditchecks.html

@@ -774,4 +774,4 @@ footer {
       <td>Vulnerable to path traversal attacks if used with untrusted archives.</td>
     </tr>
   </tbody>
-</table><br><p>Number of implemented security validations:<b>89</b></p><p>Version of codeaudit: <b>1.8.1</b><p>Because Python and cybersecurity are constantly changing, issue reports <b>SHOULD</b> specify the codeaudit version used.</p><p><b>Disclaimer:</b> <i>This SAST tool <a href="https://github.com/nocomplexity/codeaudit" target="_blank"><b>Python Code Audit</b></a> provides a powerful, automatic security analysis for Python source code. However, it's not a substitute for human review in combination with business knowledge. Undetected vulnerabilities may still exist.</i></p><p>This Python security report was created on: <b>2026-07-31 13:23</b> with <a href="https://github.com/nocomplexity/codeaudit" target="_blank"><b>Python Code Audit</b></a> version <b>1.8.1</b></p><hr><footer><div class="footer-links">Check the <a href="https://nocomplexity.com/documents/codeaudit/intro.html" target="_blank">documentation</a> for help on found issues.<br>Codeaudit is made with <span class="heart">&#10084;</span> by cyber security professionals who advocate for <a href="https://nocomplexity.com/simplify-security/" target="_blank">open simple security solutions</a>.<br><a href="https://nocomplexity.com/documents/codeaudit/CONTRIBUTE.html" target="_blank">Join the community</a> and contribute to make this tool better!</div></footer></div></body></html>
+</table><br><p>Number of implemented security validations:<b>89</b></p><p>Version of codeaudit: <b>1.9.1</b><p>Because Python and cybersecurity are constantly changing, issue reports <b>SHOULD</b> specify the codeaudit version used.</p><p><b>Disclaimer:</b> <i>This SAST tool <a href="https://github.com/nocomplexity/codeaudit" target="_blank"><b>Python Code Audit</b></a> provides a powerful, automatic security analysis for Python source code. However, it's not a substitute for human review in combination with business knowledge. Undetected vulnerabilities may still exist.</i></p><p>This Python security report was created on: <b>2026-10-09 11:58</b> with <a href="https://github.com/nocomplexity/codeaudit" target="_blank"><b>Python Code Audit</b></a> version <b>1.9.1</b></p><hr><footer><div class="footer-links">Check the <a href="https://nocomplexity.com/documents/codeaudit/intro.html" target="_blank">documentation</a> for help on found issues.<br>Codeaudit is made with <span class="heart">&#10084;</span> by cyber security professionals who advocate for <a href="https://nocomplexity.com/simplify-security/" target="_blank">open simple security solutions</a>.<br><a href="https://nocomplexity.com/documents/codeaudit/CONTRIBUTE.html" target="_blank">Join the community</a> and contribute to make this tool better!</div></footer></div></body></html>