Try out SonarQube?

[mattcristal]

SonarQube / SonarCloud should offer a free plan for public repositories, like this one.

See here:

https://www.sonarsource.com/plans-and-pricing/sonarcloud/

Perhaps something nice to try out? For example, to scan the existing project and then, to incorporate it in the CI/CD?

[pgoslatara]

Looks like that plan isn't available any more, or at least the free version doesn't include the line "Scan unlimited public projects". Also looks like SonarQube requires the installation of a GitHub App and so it only works for code already pushed to GitHub.

Regarding the security aspect, #544 added bandit to pre-commit, allowing both deveopers to run this locally and our CI pipeline to enforce this.