Code Security Scanner

About the Code Security Scanner

Paste code, or open a project folder or a ZIP of it, and the scanner looks for the mistakes behind most security bugs: SQL and shell commands built from strings or from request data, eval and code built at run time, HTML written from values, file paths taken from the request, unsafe deserialisation, XML parsers that load external entities, weak hashes and ciphers, predictable random tokens, certificate checks turned off, open CORS with credentials, debug modes left on, and keys, tokens and passwords written into the code.

JavaScript, TypeScript and Python are read as syntax trees; PHP, Java, Go, C#, Ruby, SQL scripts and settings files are checked with MySmartCoPilot’s pattern rules; and every text file goes through the Secret Scanner’s rules. Each finding shows the file and line, the CWE entry it maps to, why it is risky and a safer version. With a Pro pass you see every finding, add your own regular-expression rules, save a baseline that hides accepted findings next time, and download SARIF 2.1.0, HTML and CSV reports. The code is read in a background worker in your browser and never uploaded. Pattern checks find common mistakes; they miss logic flaws and can raise false alarms, so review what they report.

Common uses

• Checking your own project before a release, a code review or a security questionnaire.
• Finding the SQL, shell and eval calls in old code that you have inherited.
• Making sure no key, token or password was committed with the code.
• Adding a SARIF report to GitHub code scanning from a build that has no scanner of its own.

What it checks

• Injection: SQL built from strings or request data (CWE-89), shell commands (CWE-78), eval and code built at run time (CWE-95, CWE-94), HTML written from values (CWE-79), file paths from the request (CWE-22), request data that picks the class or method to call (CWE-470), regular expressions that can backtrack catastrophically (CWE-1333).
• Cryptography: passwords hashed with fast hashes (CWE-916), MD5 and SHA-1 (CWE-328), DES, RC4 and ECB mode (CWE-327), predictable random numbers for tokens (CWE-338), secrets compared with == (CWE-208).
• Parsing and transport: certificate checks turned off (CWE-295), XML parsers that resolve external entities (CWE-611), unsafe deserialisation such as pickle, unserialize, BinaryFormatter and ObjectInputStream (CWE-502).
• Settings: any origin allowed together with credentials (CWE-942), debug modes and debug endpoints (CWE-489), detailed error pages (CWE-200) — also in .env, web.config and Spring application files.
• Secrets: keys, tokens and passwords written into code or settings (CWE-798), with the Secret Scanner’s rules.

The names of the weaknesses are those of MITRE’s CWE list; each finding links to its entry.

How the code is read

JavaScript and TypeScript (with JSX) and Python are parsed into syntax trees with the parsers of the site’s code editors, so the checks see calls and their arguments, not just text: a fixed string is fine, a value built from strings or taken from the request is not. PHP, Java (also JSP), Go, C# (also Razor views), Ruby (also ERB templates) and SQL scripts are checked with pattern rules after comments are removed; string literals are read with each language’s own quoting. Data from the request is followed one step: a variable assigned straight from the request, or a parameter marked as request data (@RequestParam, [FromQuery]), counts as request data where it is used.

Reports, baselines and your own rules

• SARIF 2.1.0: each rule has its CWE tag and a security-severity score, and each result its file, line, column, snippet and a fingerprint, as GitHub code scanning reads them; upload it with the github/codeql-action/upload-sarif action (GitHub Docs), or open it in the SARIF Viewer extension for Visual Studio Code. File paths start inside the folder you chose (or the ZIP’s top folder, such as the repo-main/ of a ZIP downloaded from GitHub), the way the repository names its files — so scan the repository’s own folder for a report GitHub can match to its files.
• Baseline: a file listing the findings you have accepted. A finding’s fingerprint comes from its rule, its file and the text of its line, so it stays the same when code above it changes. A SARIF report from this scanner works as a baseline too.
• Your own rules: a regular expression with the flags i, m, s or u, the files it applies to (*.php, src/**), a severity, a CWE number and a message. A pattern that could backtrack catastrophically, or that matches an empty text, is refused so the scan cannot freeze.

Limitations

• Pattern checks find common mistakes; they miss logic flaws (broken access control, business-logic errors, race conditions) and can raise false alarms. Review each finding, and never take a clean result as proof that the code is safe.
• Request data is followed one step only; values passed through functions or other files are not followed.
• It does not run the code or check your dependencies for known vulnerabilities.
• Files over 2 MB, binaries and minified files are skipped, and one scan reads up to 50 MB. Password-protected ZIPs cannot be opened: choose the folder instead.
• The free preview shows the counts and the first 3 findings in full.

Privacy

On this device: nothing is sent

Your code is read in a background worker in this tab and never uploaded, stored or logged. Your own rules are kept in this browser so they are there next time.