[
 {
  "id": "C01",
  "http_status": 200,
  "recorded_at": "2026-11-03T23:28:47+00:00",
  "ms": 0,
  "reply": {
   "slug": "taloscode-security",
   "title": "AST security scan of Python code",
   "status": "ok",
   "input": "import os, pickle, subprocess, sqlite3\n\nAPI_KEY = \"sk-live-4f9a8b7c6d5e4f3a2b1c\"\n\ndef run(cmd):\n    return subprocess.call(cmd, shell=True)\n\ndef load(blob):\n    return pickle.loads(blob)\n\ndef find_user(db, name):\n    return db.execute(\"SELECT * FROM users WHERE name = '%s'\" % name).fetchall()\n\ndef calc(expr):\n    return eval(expr)\n",
   "total_ms": 35,
   "steps": [
    {
     "call": "POST /scan",
     "request": {
      "source_code": "import os, pickle, subprocess, sqlite3\n\nAPI_KEY = \"sk-live-4f9a8b7c6d5e4f3a2b1c\"\n\ndef run(cmd):\n    return subprocess.call(cmd, shell=True)\n\ndef load(blob):\n    return pickle.loads(blob)\n\ndef find_user(db, name):\n    return db.execute(\"SELECT * FROM users WHERE name = '%s'\" % name).fetchall()\n\ndef calc(expr):\n    return eval(expr)\n",
      "filename": "app.py"
     },
     "status": 200,
     "ms": 19,
     "reply": {
      "filename": "app.py",
      "findings": [
       {
        "vuln_type": "COMMAND_INJECTION",
        "line": 6,
        "code_snippet": "return subprocess.call(cmd, shell=True)",
        "severity": "CRITICAL",
        "cwe_id": "CWE-78",
        "recommendation": "Avoid shell=True in subprocess calls with untrusted input. Pass args as a list instead."
       },
       {
        "vuln_type": "SQL_INJECTION",
        "line": 12,
        "code_snippet": "return db.execute(\"SELECT * FROM users WHERE name = '%s'\" % name).fetchall()",
        "severity": "CRITICAL",
        "cwe_id": "CWE-89",
        "recommendation": "Use parameterized queries or an ORM. Never build SQL strings with user-supplied data."
       },
       {
        "vuln_type": "EVAL_EXEC_INJECTION",
        "line": 15,
        "code_snippet": "return eval(expr)",
        "severity": "CRITICAL",
        "cwe_id": "CWE-95",
        "recommendation": "Avoid eval()/exec() entirely. Use ast.literal_eval() for safe evaluation."
       },
       {
        "vuln_type": "HARDCODED_SECRET",
        "line": 3,
        "code_snippet": "API_KEY = \"sk-live-4f9a8b7c6d5e4f3a2b1c\"",
        "severity": "HIGH",
        "cwe_id": "CWE-798",
        "recommendation": "Store secrets in environment variables or a secrets manager."
       },
       {
        "vuln_type": "INSECURE_DESERIALIZATION",
        "line": 9,
        "code_snippet": "return pickle.loads(blob)",
        "severity": "HIGH",
        "cwe_id": "CWE-502",
        "recommendation": "Avoid pickle for untrusted data. Use yaml.safe_load() instead of yaml.load()."
       }
      ],
      "total": 5,
      "summary": {
       "CRITICAL": 3,
       "HIGH": 2,
       "MEDIUM": 0,
       "LOW": 0
      }
     }
    }
   ],
   "note": "Real calls to the running service with the public demo identity; replies are unedited."
  }
 },
 {
  "id": "C02",
  "http_status": 200,
  "recorded_at": "2026-11-03T23:28:47+00:00",
  "ms": 0,
  "reply": {
   "slug": "taloscode-security",
   "title": "AST security scan of Python code",
   "status": "ok",
   "input": "import os, pickle, subprocess, sqlite3\n\nAPI_KEY = \"sk-live-4f9a8b7c6d5e4f3a2b1c\"\n\ndef run(cmd):\n    return subprocess.call(cmd, shell=True)\n\ndef load(blob):\n    return pickle.loads(blob)\n\ndef find_user(db, name):\n    return db.execute(\"SELECT * FROM users WHERE name = '%s'\" % name).fetchall()\n\ndef calc(expr):\n    return eval(expr)\n",
   "total_ms": 35,
   "steps": [
    {
     "call": "POST /scan",
     "request": {
      "source_code": "import os, pickle, subprocess, sqlite3\n\nAPI_KEY = \"sk-live-4f9a8b7c6d5e4f3a2b1c\"\n\ndef run(cmd):\n    return subprocess.call(cmd, shell=True)\n\ndef load(blob):\n    return pickle.loads(blob)\n\ndef find_user(db, name):\n    return db.execute(\"SELECT * FROM users WHERE name = '%s'\" % name).fetchall()\n\ndef calc(expr):\n    return eval(expr)\n",
      "filename": "app.py"
     },
     "status": 200,
     "ms": 19,
     "reply": {
      "filename": "app.py",
      "findings": [
       {
        "vuln_type": "COMMAND_INJECTION",
        "line": 6,
        "code_snippet": "return subprocess.call(cmd, shell=True)",
        "severity": "CRITICAL",
        "cwe_id": "CWE-78",
        "recommendation": "Avoid shell=True in subprocess calls with untrusted input. Pass args as a list instead."
       },
       {
        "vuln_type": "SQL_INJECTION",
        "line": 12,
        "code_snippet": "return db.execute(\"SELECT * FROM users WHERE name = '%s'\" % name).fetchall()",
        "severity": "CRITICAL",
        "cwe_id": "CWE-89",
        "recommendation": "Use parameterized queries or an ORM. Never build SQL strings with user-supplied data."
       },
       {
        "vuln_type": "EVAL_EXEC_INJECTION",
        "line": 15,
        "code_snippet": "return eval(expr)",
        "severity": "CRITICAL",
        "cwe_id": "CWE-95",
        "recommendation": "Avoid eval()/exec() entirely. Use ast.literal_eval() for safe evaluation."
       },
       {
        "vuln_type": "HARDCODED_SECRET",
        "line": 3,
        "code_snippet": "API_KEY = \"sk-live-4f9a8b7c6d5e4f3a2b1c\"",
        "severity": "HIGH",
        "cwe_id": "CWE-798",
        "recommendation": "Store secrets in environment variables or a secrets manager."
       },
       {
        "vuln_type": "INSECURE_DESERIALIZATION",
        "line": 9,
        "code_snippet": "return pickle.loads(blob)",
        "severity": "HIGH",
        "cwe_id": "CWE-502",
        "recommendation": "Avoid pickle for untrusted data. Use yaml.safe_load() instead of yaml.load()."
       }
      ],
      "total": 5,
      "summary": {
       "CRITICAL": 3,
       "HIGH": 2,
       "MEDIUM": 0,
       "LOW": 0
      }
     }
    }
   ],
   "note": "Real calls to the running service with the public demo identity; replies are unedited."
  }
 }
]