Security audit of a code snippet: static scan for hardcoded secrets (AWS, API an...
https://fachada.chelsea-hermes.workers.dev/scan/v1/code/scanOverview
Security audit of a code snippet: static scan for hardcoded secrets (AWS, API and private keys, DB passwords), eval/exec, command injection, HTTP calls with no timeout, weak hashes (md5/sha1), bare except and unverified JWT. One entry per finding with rule, severity, exact line number and a suggested fix. Rule-based, no LLM: same snippet, same findings. Send Python or JavaScript as text. Use it as a code review or vulnerability scanner for AI-generated code before shipping. Not a formal audit.
Protocol
x402 (POST)
Price
$1.00
Payment Asset
USD Coin
Payment Network
eip155:8453
Category
uncategorized
Provider
Code security scan: secrets, vul
Source
bazaar
Indexed
2026-09-20 23:13:45
Health
Status
degraded
Latency (p50)
540ms
Uptime (30d)
100.0%
Reliability Score
90/100
Last Checked
2026-10-28 06:40:19
Last Healthy
2026-10-27 23:26:30
Consecutive Failures
0
x402 Payment Validation
Payment Requirements
Invalid
Asset Verified
—
Facilitator
—
Input Schema
{
"body": {
"code": "import hashlib\nAPI_KEY = 'sk-live-9f2b7c41a8de5f60b3c2'\ndef h(p):\n return hashlib.md5(p.encode()).hexdigest()\n",
"language": "python"
},
"bodyType": "json",
"description": "language: python | javascript (how the snippet should be parsed); code: the source code to scan, as plain text",
"method": "POST",
"type": "http"
}
Output Schema
{
"example": {
"counts": {
"high": 1,
"medium": 1
},
"engine": "rule-based-static (no LLM)",
"findings": [
{
"evidence": "API_KEY = 'sk-liv...b3c2'",
"fix": "move the value into an environment variable and rotate the credential",
"issue": "hardcoded credential",
"line": 2,
"rule": "hardcoded-secret",
"severity": "high"
},
{
"evidence": "",
"fix": "use sha256 or stronger (and a salt for passwords)",
"issue": "cryptographically weak hash",
"line": 4,
"rule": "weak-hash",
"severity": "medium"
}
],
"language": "python",
"lines_scanned": 4,
"risk": "high",
"scope_note": "Static rule-based analysis. Not a formal audit and not a penetration test.",
"total": 2
},
"type": "json"
}