The solution to what you want is not to analyze the code projects automagically, but rather to run them in a container/virtual machine. Running them in an environment which restricts what they can access limits the harm an intentional — or accidental bug can do.
There is no way to automatically analyze code for malice, or bugs with 100% reliability.
Of course, 100% reliability is impossible even with human reviewers. I just want a tool that gives me at least something, cause I don’t have the time or knowledge to review a full repo before executing it on my machine.
That is another tool you can use to reduce the risk of malicious code, but it isn’t perfect, so using sandboxing doesn’t mean you can forget about all other security tools.
There is no way to automatically analyze code for malice, or bugs with 100% reliability.
He wasn’t asking for 100% reliability. 100% and 0% are not the only possibilities.
The solution to what you want is not to analyze the code projects automagically, but rather to run them in a container/virtual machine. Running them in an environment which restricts what they can access limits the harm an intentional — or accidental bug can do.
There is no way to automatically analyze code for malice, or bugs with 100% reliability.
Of course, 100% reliability is impossible even with human reviewers. I just want a tool that gives me at least something, cause I don’t have the time or knowledge to review a full repo before executing it on my machine.
That is another tool you can use to reduce the risk of malicious code, but it isn’t perfect, so using sandboxing doesn’t mean you can forget about all other security tools.
He wasn’t asking for 100% reliability. 100% and 0% are not the only possibilities.