{"slug":"fachada-chelsea-hermes-workers-dev-scan-v1-code-scan-5dc60a","title":"Static security scan of a code snippet","host":"fachada.chelsea-hermes.workers.dev","method":"POST","resource":"https://fachada.chelsea-hermes.workers.dev/scan/v1/code/scan","category":"code","description":"Static security scan of a code snippet. Finds hardcoded secrets (AWS keys, private keys, API keys, DB connection strings with passwords), eval/exec, command injection, HTTP calls with no timeout, weak hashes (md5/sha1), bare except and unverified JWT. Returns one entry per finding with rule, severit","price_listed":0.01,"price_asked":null,"state":"effects","state_label":"Not tested: has real-world effects","checks_7d":0,"answered_7d":0,"latency_ms_median":null,"reported_calls_30d":2,"reported_payers_30d":1,"networks":["eip155:8453"],"badge":"unverified","paid_checks_7d":0,"paid_ok_7d":0,"example_input":{"body":{"code":"import hashlib\nAPI_KEY = 'sk-live-9f2b7c41a8de5f60b3c2'\ndef h(p):\n    return hashlib.md5(p.encode()).hexdigest()\n","language":"python"},"bodyType":"json","description":"language: python | javascript (how the snippet should be parsed); code: the source code to scan, as plain text","method":"POST","type":"http"},"output_schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","properties":{"input":{"additionalProperties":false,"properties":{"body":{"type":"object"},"bodyType":{"enum":["json","form-data","text"]},"description":{"type":"string"},"method":{"enum":["POST"],"type":"string"},"type":{"const":"http","type":"string"}},"required":["type","method"],"type":"object"},"output":{"additionalProperties":false,"properties":{"example":{"type":"object"},"type":{"const":"json","type":"string"}},"required":["type"],"type":"object"}},"type":"object"},"history":[],"description_full":"Static security scan of a code snippet. Finds hardcoded secrets (AWS keys, private keys, API keys, DB connection strings with passwords), eval/exec, command injection, HTTP calls with no timeout, weak hashes (md5/sha1), bare except and unverified JWT. Returns one entry per finding with rule, severity, exact line number, the offending line and a suggested fix. Rule-based and deterministic: no LLM, so the same snippet always returns the same findings. Send Python or JavaScript as plain text. Not a","last_updated":"2026-09-21T21:15:18.544Z","schemes":["exact"]}