Public proof, without repository uploads
See what the review can actually prove.
Agent PR X-Rays are static exports from completed local reviews. Every example keeps failed, waived, missing, and unverified stages visible instead of polishing them into a green badge.
Reviewed examples
Benchmark ground truth · static HTMLUnchecked error return in Go
The error return from os.WriteFile is discarded, so disk-full, permission, and invalid-path failures are silently swallowed and callers assume the config was saved.
source.go:12Hardcoded database credentials in Go
Production database username, password, and host are committed in plaintext as package-level constants, exposing credentials to anyone with repository access.
source.go:7Nil-pointer dereference on missing map value in Go
FindUser dereferences u.Email without checking that the map lookup returned a non-nil pointer, so a missing id causes a nil pointer dereference and a process crash.
source.go:16Data race on a shared Go map
Multiple goroutines read and write the same map without a mutex or another synchronization boundary.
source.go:14SQL injection via fmt.Sprintf in Go
User-supplied email is interpolated into the SQL query via fmt.Sprintf instead of parameterized placeholders, allowing injection of arbitrary SQL.
source.go:13Predictable PRNG for security tokens in Java
Reset tokens are generated with java.util.Random, a predictable PRNG whose seed is recoverable from observed outputs, allowing token forgery. SecureRandom should be used instead.
source.java:10Arbitrary code execution via eval() in JavaScript
Caller-supplied expression is passed directly to eval(), turning any user-controlled value into executing JavaScript and enabling arbitrary code execution.
source.js:7Open redirect via unvalidated URL in Express
The next query parameter is passed directly to res.redirect without an allowlist or same-origin check, enabling phishing redirects off the trusted domain.
source.js:9Bare except swallows all errors in Python
A bare except catches BaseException (including KeyboardInterrupt and SystemExit), hides JSON parse failures, and silently returns an empty dict so callers never learn the config failed to parse.
source.py:9Command injection via subprocess shell=True in Python
subprocess.run is called with shell=True and a string command containing user-controlled host, allowing shell metacharacters to inject arbitrary commands.
source.py:9Hardcoded cloud API credentials in Python
A live AWS access key id and secret access key are hardcoded in source. Anyone with repository access can extract and abuse these credentials.
source.py:10Insecure pickle deserialization in Python
pickle.loads is called on a user-supplied base64 blob. pickle can execute arbitrary code during deserialization, so untrusted input lets an attacker run any payload on the server.
source.py:9Path traversal in a Python file handler
The requested filename is joined to the storage root without canonical containment validation.
source.py:9SQL injection via f-string in Python
User-supplied name is interpolated into the SQL query via an f-string, allowing injection of arbitrary SQL such as a UNION SELECT to exfiltrate other tables.
source.py:8Server-side request forgery in Python
The server fetches a user-supplied URL with no scheme, host, or private-range restrictions, allowing requests to cloud metadata endpoints (e.g. 169.254.169.254) to steal credentials or to internal services for pivoting.
source.py:9Weak password hashing with MD5 in Python
Passwords are hashed with unsalted MD5, which is cryptographically broken and trivially reversed with rainbow tables; identical passwords produce identical hashes.
source.py:7Unbounded zip extraction (zip bomb) in Python
extractall is called without checking uncompressed sizes or compression ratios, so a small zip bomb can decompress to petabytes and exhaust disk and memory.
source.py:9Unchecked integer arithmetic in Rust
credit uses += on u64 without checked/saturating arithmetic; in release builds an overflowing credit wraps the balance silently, enabling balance manipulation.
source.rs:11Unreachable code after unconditional return
The if (score >= 70) branch and final return are unreachable because an unconditional return at line 8 always exits the function first.
source.ts:12Hardcoded database password in TypeScript
The production database password is committed in plaintext inside the source file, exposing credentials to anyone with repository access.
source.ts:8Insecure session cookie attributes in TypeScript
The session cookie is set without Secure, HttpOnly, or SameSite attributes, so it is transmitted over HTTP, readable by JavaScript/XSS, and vulnerable to CSRF.
source.ts:8Missing await on async operation in TypeScript
deleteSession returns a promise but is not awaited, so a rejection becomes an unhandled promise rejection and logout resolves before the session is actually deleted, leaving stale sessions.
source.ts:8Prototype pollution via recursive merge in TypeScript
The recursive merge walks user-supplied keys without blocking __proto__/constructor/prototype, so a payload like {"__proto__": {"admin": true}} pollutes Object.prototype and escalates privileges across the application.
source.ts:11Catastrophic backtracking regex (ReDoS) in TypeScript
The regex uses a nested + quantifier ((...+)+) causing exponential backtracking on non-matching inputs; a long crafted string hangs the event loop and denies service to all other requests.
source.ts:4SQL injection in a TypeScript lookup
The lookup builds SQL with user-controlled email input instead of a parameterized query.
source.ts:13Type-safety bypass via `as any` in TypeScript
The payload is cast through `as any` to Order, bypassing the compiler so a Refund-shaped object is treated as an Order; at runtime items is undefined and the .length access throws or silently corrupts downstream totals.
source.ts:19Reflected XSS via dangerouslySetInnerHTML in React
User-supplied comment body is rendered as raw HTML via dangerouslySetInnerHTML without any sanitization, enabling stored/reflected XSS.
source.tsx:12