Yasca
title: "Yasca" type: doc version: 1 created: 2026-02-28 author: "Wikipedia contributors" status: active scope: public tags: ["static-program-analysis-tools", "software-using-the-bsd-license"] topic_path: "general/static-program-analysis-tools" source: "https://en.wikipedia.org/wiki/Yasca" license: "CC BY-SA 4.0" wikipedia_page_id: 0 wikipedia_revision_id: 0
::data[format=table title="Infobox Software"]
| Field | Value |
|---|---|
| name | Yasca |
| screenshot | Yascas Logo.png |
| caption | "Yet Another Source Code Analyzer" |
| developer | Michael Scovetta |
| latest release version | 2.2 |
| latest release date | |
| operating system | Cross-platform |
| size | 12MB-155MB |
| language | English |
| programming language | PHP, Java |
| genre | Software Quality, Software Security |
| license | BSD License, GPL License, GNU Lesser General Public License, Others |
| website | , |
| ::
| name = Yasca | logo = | screenshot = Yascas Logo.png | caption = "Yet Another Source Code Analyzer" | developer = Michael Scovetta | latest release version = 2.2 | latest release date = | latest preview version = | latest preview date = | operating system = Cross-platform | size = 12MB-155MB | language = English | programming language = PHP, Java | genre = Software Quality, Software Security | license = BSD License, GPL License, GNU Lesser General Public License, Others | website = ,
Yasca is an open source program which looks for security vulnerabilities, code-quality, performance, and conformance to best practices in program source code. It leverages external open source programs, such as FindBugs, PMD, JLint, JavaScript Lint, PHPLint, Cppcheck, ClamAV, Pixy, and RATS to scan specific file types, and also contains many custom scanners developed for Yasca. It is a command-line tool that generates reports in HTML, CSV, XML, MySQL, SQLite, and other formats. It is listed as an inactive project at the well-known OWASP security project, and also in a government software security tools review at the U.S Department of Homeland Security web site.
Languages Scanned
Yasca has at least one scanner for each of the following file types:
- .NET (VB.NET, C#, ASP.NET)
- ASP
- C/C++
- COBOL
- ColdFusion
- CSS
- HTML
- Java
- JavaScript
- Perl
- PHP
- Python
- Raw HTTP Traffic
- Visual Basic
Yasca 2.2
Version 2.2 was released in June 2010 and included a large number of minor updates over version 2.1, most notably, natively compiled plugins on Linux, reducing the need to use Wine. Version 2.2 contains some experimental modules, including a TCP packet logger and a rule to scan those logs for sensitive information. Additional rules for this are expected in the next update.
As with prior 2.x releases, Yasca comes packaged as a core bundle, plus separately downloadable plugins. No plugins are required, but best results occur when using all of the necessary plugins.
References
References
- Clarke, Justin. (2009). "SQL Injection Attacks and Defense". Syngress.
- "Category:OWASP Yasca Project". OWASP.
- "Software Security Assessment Tools Review". Homeland Security.
::callout[type=info title="Wikipedia Source"] This article was imported from Wikipedia and is available under the Creative Commons Attribution-ShareAlike 4.0 License. Content has been adapted to SurfDoc format. Original contributors can be found on the article history page. ::