# FeeiCN/Cobra

Source Code Security Audit (源代码安全审计)

Repository: https://github.com/FeeiCN/Cobra
Canonical: https://ross.abutalabs.com/products/feeicn-cobra
Homepage: http://cobra.feei.cn
Language: Python
License: MIT
License Family: permissive
Topics: cobra, code-audit, sourcecode-analysis, security-tools, security-audit, security-scanner
Archived: true
Last push: 2022-09-16T17:46:29+00:00

## Health v2 (maintenance only)
Score: 10/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 0, release rhythm 8, longevity 100
- inputs: {"age_days": 3792, "days_push": 1447, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: archived
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 3186, forks 939 (observed 2026-08-28T04:07:48.023396+00:00)

## What it is
Cobra is a source code security audit (SAST) tool that scans PHP, Java, and other languages for common vulnerabilities like SQL injection, XSS, and hard-coded credentials, using regex rules and AST-based taint analysis. It offers CLI, API, and web GUI modes and detects vulnerable third-party dependencies.

## Use cases
- scan php source code for security vulnerabilities
- audit java codebase for sql injection and xss
- detect hard-coded passwords in source code
- find vulnerable third-party dependencies in a project
- integrate security scanning into ci pipeline
- automated white-box code security audit

## When to choose
- you need a free, self-hosted SAST scanner for PHP or Java code
- you want to detect OWASP Top 10 issues plus vulnerable dependencies in one pass
- you need an API to hook code scanning into release or CI systems

## When to avoid
- you need a maintained tool - the project is explicitly unmaintained and not for production use
- you need deep AST-based analysis for languages other than PHP
- you work on Windows, which is unsupported

## Facets
- artifact type: cli-tool
- maturity: abandoned
- function: vulnerability-scanning, security, parser, cli
- domain: security, developer-tools, penetration-testing
- platform: python, cli
- tags: static-analysis, sast, code-audit, source-code-scanning, php, java, owasp-top-10, unmaintained, linux, macos

## Member repositories
- FeeiCN/Cobra (main) score 10

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:07:48.023396+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T07:24:59.709668+00:00, confidence not recorded.
  - readme: https://github.com/FeeiCN/Cobra (fetched 2026-08-28T04:07:48.023396+00:00, sha 2e458849b952)
  - homepage: http://cobra.feei.cn (fetched 2026-08-29T09:38:53.363437+00:00, sha 057a3dc0a25d)
  - site_page: http://cobra.feei.cn/installation (fetched 2026-08-29T09:38:53.432098+00:00, sha 61233cce0ee7)
- Data as of 2026-08-30T08:39:29.467469+00:00.