Demo Mode — you're viewing a sample report with pre-loaded example data. No account or real scan is used.
Create an accountSummary
Sample verification statuses: VERIFIED: 1 · SUSPECTED: 3 · FALSE_POSITIVE: 1
Sample project
This is how a project, its scans, and its reports appear inside a real account.
| Name | Created | |
|---|
| sample-petstore-api | Aug 20, 2026, 10:15 AM | Sample |
Scans
| Scan | Profile | Status | Created |
|---|
| demo-job… | standard | completed | Aug 21, 2026, 04:35 PM |
| demo-job… | fast | completed | Aug 22, 2026, 09:05 AM |
Report
| Report | Target | Created |
|---|
| demo-rep… | sample-petstore-api | Aug 21, 2026, 04:40 PM |
Findings (5)
Legend:CriticalHighMediumLowVerifiedSuspected (unconfirmed)False positive
routes/auth.py:24
Description
User-supplied input is concatenated into a SQL statement before execution, which can let an attacker alter the query logic.
cursor.execute(f"SELECT * FROM users WHERE name = '{username}'")Evidence
Verified in an isolated sandbox: a crafted username caused the query to return unintended rows, confirming the injection is reachable.
Remediation
Use parameterized queries (e.g. cursor.execute('... %s', (username,))) so input is never treated as SQL.
config.py:11
Description
A credential-looking literal is assigned directly in source code and committed to the repository.
API_KEY = "sk-live-abcdef123456"
parsers.py:18
Description
yaml.load without an explicit safe loader can construct arbitrary objects, enabling remote code execution.
return yaml.load(stream)
utils.py:41
Description
A subprocess invocation passes the command through a shell interpreter, which can allow command injection.
subprocess.run(f"ls {path}", shell=True)Evidence
Probed in the sandbox: the interpolated value is validated and cannot break out of the command. Reported as a false positive.
calc.py:7
Description
Dynamic evaluation of code via eval can execute attacker-controllable input if it ever reaches an untrusted source.
result = eval(expression)
Findings marked Suspected (unconfirmed) or Unverified are candidate issues that have not been confirmed by the verification engine. Treat them as leads, not confirmed vulnerabilities. This is sample data and does not come from a real scan.
Like what you see?
Create a free account to scan your own projects, verify findings in an isolated sandbox, and export structured reports.