# Security scanning of Julia code
**URL:** https://discourse.julialang.org/t/security-scanning-of-julia-code/24253
**Category:** Tooling
**Tags:** security
**Created:** [May 15, 2019, 7:00pm UTC](https://discourse.julialang.org/t/security-scanning-of-julia-code/24253 "2019-05-15T19:00:21Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@bluesmoon](https://discourse.julialang.org/u/bluesmoon)
#### Post date: [May 15, 2019, 7:00pm UTC](https://discourse.julialang.org/t/security-scanning-of-julia-code/24253/1 "2019-05-15T19:00:21Z")
Hi all,
I was wondering what other people do to keep track of scanning Julia code for security vulnerabilities and if any vulnerabilities get reported to CVE.
Thanks,
Philip
---
### Author:  [@jpsamaroo](https://discourse.julialang.org/u/jpsamaroo)
#### Post date: [May 16, 2019, 12:20pm UTC](https://discourse.julialang.org/t/security-scanning-of-julia-code/24253/2 "2019-05-16T12:20:53Z")
I don’t think there are many people that track vulnerabilities in Julia packages, and if they do, they probably do it by manually auditing/fuzz testing packages they use.
---
### Author:  [@bluesmoon](https://discourse.julialang.org/u/bluesmoon)
#### Post date: [May 16, 2019, 12:59pm UTC](https://discourse.julialang.org/t/security-scanning-of-julia-code/24253/3 "2019-05-16T12:59:10Z")
Thanks. That was kind of my impression too, so I’d also be interested in what kind of fuzz testing others do for Julia.
---
### Author:  [@oheil](https://discourse.julialang.org/u/oheil)
#### Post date: [May 16, 2019, 1:10pm UTC](https://discourse.julialang.org/t/security-scanning-of-julia-code/24253/4 "2019-05-16T13:10:10Z")
There is a related discussion:
> [@Use a tool like Codacy to check common issues pattern](https://discourse.julialang.org/t/use-a-tool-like-codacy-to-check-common-issues-pattern/23855):
>
> Recently, I used Codacy on my fork of Julia, and [it discovered 936 issues](https://app.codacy.com/project/hossein_pourbozorg/julia/dashboard) (237 security + 36 error prone + 663 code style). So I think to suggest a discussion about “Use a tool like Codacy to check common issues pattern” for speed up issue discovering. I mark all issues pattern to check, so it leaves some ineffective issues. But if we configure it proper, it can be useful. [Screenshot%20from%202019-05-05%2002-43-13]
---
### Author:  [@Tamas\_Papp](https://discourse.julialang.org/u/Tamas_Papp)
#### Post date: [May 16, 2019, 2:20pm UTC](https://discourse.julialang.org/t/security-scanning-of-julia-code/24253/5 "2019-05-16T14:20:01Z")
> [@bluesmoon](#):
>
> scanning Julia code for security vulnerabilities and if any vulnerabilities get reported to CVE.
I don’t think this is something that CVE would track at the moment even if people submitted, see
[https://cve.mitre.org/cve/request\_id.html](https://cve.mitre.org/cve/request_id.html)
CVE does not track _everything_, just what they think is relevant for cybersecurity.
---
### Author:  [@jpsamaroo](https://discourse.julialang.org/u/jpsamaroo)
#### Post date: [May 16, 2019, 3:51pm UTC](https://discourse.julialang.org/t/security-scanning-of-julia-code/24253/6 "2019-05-16T15:51:29Z")
I think the best way to accomplish the same goal of determining which packages have the potential to cause a security incident, is to setup fuzz testing and mutation testing infrastructure for Julia, and apply it regularly to registered packages (maybe per commit or PR as part of CI). I think it’d be really cool to have tools like these, if not for the purposes of security, then for the purposes of reliability from a usage standpoint. The only example I know of (but I haven’t yet used) is: [GitHub - vchuravy/ConcolicFuzzer.jl: Prototype of a fuzzer for Julia based on concolic execution](https://github.com/vchuravy/ConcolicFuzzer.jl)