{"uid":"cap_Wih0HoHvcr5EO76j3Qfzu","slug":"code-security-scanner-6e9a5f61","name":"Code Security Scanner","description":"Static security scan of a code snippet. Finds hardcoded secrets (AWS keys, private keys, API keys, DB connection strings with passwords), eval/exec, command injection, HTTP calls with no timeout, weak hashes (md5/sha1), bare except and unverified JWT. Returns one entry per finding with rule, severity, exact line number, the offending line and a suggested fix. Rule-based and deterministic: no LLM, so the same snippet always returns the same findings. Send Python or JavaScript as plain text. Not a","url":"https://fachada.chelsea-hermes.workers.dev/scan/v1/code/scan?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","properties":{"input":{"type":"object","required":["type","method"],"properties":{"body":{"type":"object"},"type":{"type":"string","const":"http"},"method":{"enum":["POST"],"type":"string"},"bodyType":{"enum":["json","form-data","text"]},"description":{"type":"string"}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string","const":"json"},"example":{"type":"object"}},"additionalProperties":false}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"1","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$1/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"1","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"1","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_p0mFIfosoCuvi41mdIaOc","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"1","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Performs deterministic, rule-based static security analysis on Python or JavaScript code snippets, flagging hardcoded secrets, injection risks, weak hashes, and other vulnerabilities with line-level findings and fix suggestions.","exampleAgentPrompt":"Can you scan this Python snippet for security issues — check for hardcoded API keys, weak hashes, command injection, and any eval calls, and tell me exactly which lines are problematic and how to fix them?","exampleUseCases":[{"title":"Pre-commit secret leak check","prompt":"Before I push this Python file, scan it for any hardcoded AWS keys, database passwords, or API secrets that might accidentally end up in version control — give me the exact lines and how to fix them."},{"title":"JavaScript security audit for a PR review","prompt":"I'm reviewing a pull request and want to quickly check this JavaScript snippet for eval usage, command injection risks, HTTP calls missing a timeout, and any weak hashes like md5 — list every finding with the line number and a suggested fix."},{"title":"Catch vulnerable auth code","prompt":"Can you check this Python authentication code for unverified JWTs, bare except blocks that might swallow errors, and any hardcoded private keys — I need the severity and exact location of each issue."}],"resultDescription":"Returns an array of findings, each containing the rule name triggered, severity level, exact line number, the offending line of code, and a suggested fix. The same input always produces the same output since the scan is deterministic and rule-based (no LLM involved).","failureModes":["Unsupported language submitted (only Python and JavaScript are supported)","Empty or malformed code body returns no findings or an error","Very large snippets may be truncated or time out","Obfuscated code may evade rule-based patterns","False negatives for dynamically constructed secrets not detectable statically"],"whenToPreferThis":"Choose this endpoint when you need fast, deterministic, reproducible security scanning of Python or JavaScript code snippets without relying on an LLM. Ideal for pre-commit hooks, CI/CD pipeline checks, or agent-driven code review where consistent rule-based results are required. Prefer this over LLM-based code review when auditability and repeatability matter, or when scanning for a well-defined set of known vulnerability patterns like hardcoded secrets, weak hashes, or injection vectors.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-18T00:32:31.814Z","isFirstParty":false,"canonicalSlug":"code-security-scanner-6e9a5f61"}