{"uid":"cap_IKWl-0sijO1s9Xn0g9eYI","slug":"api-strale-io-e8a2b5a9","name":"Strale AI Code Review","description":"AI code review. Returns issues with severity, line numbers, fix suggestions. Focus on security, performance, readability, or bugs.","url":"https://api.strale.io/x402/code-review","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"code":{"type":"string"},"focus":{"type":"string","description":"security/performance/readability/bugs/all"},"language":{"type":"string"}}},"responseSchema":null,"example":{"request":{"code":"def authenticate_user(username, password):\n    user = db.query('SELECT * FROM users WHERE username = \"' + username + '\" AND password = \"' + password + '\"')\n    if user:\n        return True\n    return False","focus":"security","language":"python"},"response":{"_meta":{"payment":{"method":"x402","price_usd":0.21600000000000003,"settlement_id":"0xde41e3f14ad7207fe8febd6274d166a5ec827eb96e36220b8c850b9a50065b1b"},"capability":"code-review","latency_ms":6165,"provenance":{"source":"claude-haiku","fetched_at":"2026-06-13T04:25:06.117Z"}},"focus":"security","issues":[{"category":"security","severity":"critical","description":"SQL Injection vulnerability: User input is directly concatenated into SQL query without sanitization or parameterization","line_number":2,"fix_suggestion":"Use parameterized queries with placeholders: db.query('SELECT * FROM users WHERE username = ? AND password = ?', (username, password))"},{"category":"security","severity":"critical","description":"Passwords stored in plaintext in database and compared directly. No hashing or salting used","line_number":2,"fix_suggestion":"Hash passwords using bcrypt, argon2, or PBKDF2. Compare hashed values: bcrypt.checkpw(password.encode(), stored_hash)"},{"category":"security","severity":"high","description":"No rate limiting or account lockout mechanism to prevent brute force attacks","line_number":1,"fix_suggestion":"Implement rate limiting using libraries like Flask-Limiter or add login attempt tracking with exponential backoff"},{"category":"security","severity":"high","description":"No protection against timing attacks; execution time reveals whether username exists","line_number":2,"fix_suggestion":"Use constant-time comparison and always query database even for non-existent users"},{"category":"readability","severity":"high","description":"No input validation or sanitization before query execution","line_number":2,"fix_suggestion":"Add input validation: check username/password length, format, and allowed characters"},{"category":"bug","severity":"medium","description":"Function returns True/False instead of user object or session token; caller cannot access user data","line_number":3,"fix_suggestion":"Return user object or create session/JWT token: return {'user_id': user.id, 'token': generate_token(user)}"},{"category":"readability","severity":"medium","description":"No error handling for database connection failures or query exceptions","line_number":1,"fix_suggestion":"Add try-except block to catch database errors and log them appropriately"}],"summary":"This code contains critical SQL injection and plaintext password vulnerabilities that would allow attackers to bypass authentication or access unauthorized data. It requires immediate remediation before any production use.","quick_wins":["Replace string concatenation with parameterized queries immediately","Hash all passwords using a modern algorithm (bcrypt/argon2)","Add basic input validation and length checks","Add try-except for database operations"],"code_length":205,"overall_score":15,"security_flags":["SQL_INJECTION","PLAINTEXT_PASSWORD_STORAGE","NO_RATE_LIMITING","TIMING_ATTACK_VULNERABILITY","NO_INPUT_VALIDATION","INSUFFICIENT_AUTHENTICATION_RESPONSE"],"positive_aspects":["Function has clear, single responsibility","Simple and easy to understand intent"],"language_detected":"python"}},"exampleRequest":{"code":"def authenticate_user(username, password):\n    user = db.query('SELECT * FROM users WHERE username = \"' + username + '\" AND password = \"' + password + '\"')\n    if user:\n        return True\n    return False","focus":"security","language":"python"},"tags":["x402"],"displayCostAmount":"0.216001","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"settled","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.216001/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.216","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.216","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_643T_hM5ghEjviSN51iPV","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.216","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Performs AI-powered code review returning issues with severity, line numbers, and fix suggestions focused on security, performance, readability, or bugs.","exampleAgentPrompt":"Can you review this Python function for security vulnerabilities and tell me the line numbers where issues occur along with how to fix them?\n\n```python\ndef get_user(user_id):\n    query = f'SELECT * FROM users WHERE id = {user_id}'\n    return db.execute(query)\n```","exampleUseCases":null,"resultDescription":"A structured list of code issues, each with severity level, line number(s), a description of the problem, and a suggested fix. Issues are categorized by the requested focus area (security, performance, readability, bugs, or all).","failureModes":["Empty or missing code field returns validation error","Unsupported language may reduce accuracy of analysis","Very large code snippets may be truncated or time out","Ambiguous focus value not matching enum may default to 'all' or return error","Minified or obfuscated code may produce low-quality results"],"whenToPreferThis":"Use this endpoint when you need automated, on-demand code review with structured output including line-level issue location and concrete fix suggestions. Ideal for CI pipelines, agent-driven code quality checks, or quick pre-commit reviews without setting up a full static analysis toolchain.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-15T18:52:09.950Z","isFirstParty":false}