Code security scan: secrets, vul

Security audit of a code snippet: static scan for hardcoded secrets (AWS, API and private keys, DB passwords), eval/exec, command injection, HTTP calls with no timeout, weak hashes (md5/sha1), bare except and unverified JWT. One entry per finding with rule, severity, exact line number and a suggested fix. Rule-based, no LLM: same snippet, same findings. Send Python or JavaScript as text. Use it as

Open endpoint ↗

Price per call: $1.00
Chain: Base
Method: POST
Paid calls · 30 days: 6

Call it from code

This API is run by its own provider and paid directly through x402. We list it so you can find it; we don't route or hold the payment.

import { x402Client, wrapFetchWithPayment } from "@x402/fetch";
import { registerExactEvmScheme } from "@x402/evm/exact/client";

const client = new x402Client();
registerExactEvmScheme(client, { signer: agentAccount });

const pay = wrapFetchWithPayment(fetch, client);
const res = await pay("https://fachada.chelsea-hermes.workers.dev/scan/v1/code/scan", { method: "POST" });
console.log(await res.json());

https://fachada.chelsea-hermes.workers.dev/scan/v1/code/scan