Evally
Start free
Engineering

Vulnerable code check

Flag injection, path traversal, hardcoded secrets and other common holes in a change.

Point it at a function or a diff. Jev names the weakness if there is one (SQL or command injection, cross-site scripting, path traversal, server-side request forgery, a hardcoded secret, weak crypto, a skipped permission check), then checks whether outside input can reach it and whether an attacker could use it. A public benchmark of Jev on matched vulnerable and fixed code is where this pattern comes from.

Use this judgeCustomize it

Try it live

Real calls to Jev. Pick an example or paste your own.

Examples
117
56
No verdict yet

Pick an example or paste your own input, then run it.

Under the hood

Every question and rule, in the open. Fork it to change any of them.

What it asks

Reads code and context, then asks 4 questions in one call.

  1. Q1WeaknessPick one

    Which security weakness, if any, does the code have?

    SQL injectionCommand injectionCross-site scriptingPath traversalServer-side request forgeryHardcoded secretWeak cryptoMissing checkUnsafe deserializationNone
  2. Q2Reachable from outsideYes / no

    Can input from outside (a user, a request, an uploaded file) reach the risky part of the code, given the context?

  3. Q3ExploitableYes / no

    Could an attacker use the code to read data they shouldn't, run their own code, or act as someone else?

  4. Q4SeverityScore

    If someone exploited the code, how bad would it be?

    1. 0None: there's nothing to exploit
    2. 1Low: limited impact, or hard to reach
    3. 2High: exposes data or lets someone take over an account
    4. 3Critical: lets someone run code or read everything

How it decides

Rules run in code, top to bottom. The first one that matches gives the verdict.

  1. 1
    If Weakness is not None and Exploitable ≥ 0.6Vulnerable
  2. 2
    If Severity ≥ 2.2 of 3Vulnerable
  3. 3
    If Weakness is not NoneReviewreview
  4. 4
    If Severity ≥ 1.2 of 3Reviewreview
  5. ·
    DefaultClean

Call it from your code

Every template runs as-is with an API key, no setup: POST /api/v1/judges/vulnerable-code-check/run.

curl -X POST https://tryevally.com/api/v1/judges/vulnerable-code-check/run \  -H "Authorization: Bearer $EVALLY_API_KEY" \  -H "Content-Type: application/json" \  -d '{  "input": {    "code": "def find_user(name):\n    query = f\"SELECT * FROM users WHERE name = '\''{name}'\''\"\n    return db.execute(query).fetchall()",    "context": "Called with the ?name= parameter of a public search page"  }}'

Seen in the wild

Community builds on Jev that use this pattern. Not affiliated with Evally.

More in Engineering