{
  "x402Version": 2,
  "id": 38392,
  "slug": "38392",
  "resource": "https://fachada.chelsea-hermes.workers.dev/scan/v1/code/scan",
  "description": "Static security scan of a code snippet. Finds hardcoded secrets (AWS keys, private keys, API keys, DB connection strings with passwords), eval/exec, command injection, HTTP calls with no timeout, weak hashes (md5/sha1), bare except and unverified JWT. Returns one entry per finding with rule, severity, exact line number, the offending line and a suggested fix. Rule-based and deterministic: no LLM, so the same snippet always returns the same findings. Send Python or JavaScript as plain text. Not a",
  "type": "http",
  "serviceName": "Code security scan",
  "resourceType": "AI Inference",
  "accepts": [
    {
      "scheme": "exact",
      "network": "eip155:8453",
      "payTo": "0x734DD50Abb63ea5Af3D92b8016825475694BD883",
      "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
      "amount": "1000000",
      "amountUsd": 1,
      "maxTimeoutSeconds": 300
    }
  ],
  "outputSchema": {
    "additionalProperties": false,
    "properties": {
      "example": {
        "type": "object"
      },
      "type": {
        "const": "json",
        "type": "string"
      }
    },
    "required": [
      "type"
    ],
    "type": "object"
  },
  "extensions": {
    "bazaar": {
      "info": {
        "input": {
          "body": {
            "code": "import hashlib\nAPI_KEY = 'sk-live-9f2b7c41a8de5f60b3c2'\ndef h(p):\n    return hashlib.md5(p.encode()).hexdigest()\n",
            "language": "python"
          },
          "bodyType": "json",
          "description": "language: python | javascript (how the snippet should be parsed); code: the source code to scan, as plain text",
          "method": "POST",
          "type": "http"
        },
        "output": {
          "example": {
            "counts": {
              "high": 1,
              "medium": 1
            },
            "engine": "rule-based-static (no LLM)",
            "findings": [
              {
                "evidence": "API_KEY = 'sk-liv...b3c2'",
                "fix": "move the value into an environment variable and rotate the credential",
                "issue": "hardcoded credential",
                "line": 2,
                "rule": "hardcoded-secret",
                "severity": "high"
              },
              {
                "evidence": "",
                "fix": "use sha256 or stronger (and a salt for passwords)",
                "issue": "cryptographically weak hash",
                "line": 4,
                "rule": "weak-hash",
                "severity": "medium"
              }
            ],
            "language": "python",
            "lines_scanned": 4,
            "risk": "high",
            "scope_note": "Static rule-based analysis. Not a formal audit and not a penetration test.",
            "total": 2
          },
          "type": "json"
        }
      },
      "schema": {
        "$schema": "https://json-schema.org/draft/2020-12/schema",
        "properties": {
          "input": {
            "additionalProperties": false,
            "properties": {
              "body": {
                "type": "object"
              },
              "bodyType": {
                "enum": [
                  "json",
                  "form-data",
                  "text"
                ]
              },
              "description": {
                "type": "string"
              },
              "method": {
                "enum": [
                  "POST"
                ],
                "type": "string"
              },
              "type": {
                "const": "http",
                "type": "string"
              }
            },
            "required": [
              "type",
              "method"
            ],
            "type": "object"
          },
          "output": {
            "additionalProperties": false,
            "properties": {
              "example": {
                "type": "object"
              },
              "type": {
                "const": "json",
                "type": "string"
              }
            },
            "required": [
              "type"
            ],
            "type": "object"
          }
        },
        "type": "object"
      }
    }
  },
  "tags": [
    "security",
    "code",
    "static-analysis",
    "sast",
    "python",
    "bazaar"
  ],
  "sourceHost": "fachada.chelsea-hermes.workers.dev",
  "lastUpdated": "2026-09-28T00:16:40.999Z",
  "quality": {
    "calls30d": 4,
    "uniquePayers30d": 1,
    "lastCalledAt": "2026-09-28T00:16:40.478Z"
  },
  "metadata": {
    "serviceName": "Code security scan",
    "extensions": {
      "bazaar": {
        "info": {
          "input": {
            "body": {
              "code": "import hashlib\nAPI_KEY = 'sk-live-9f2b7c41a8de5f60b3c2'\ndef h(p):\n    return hashlib.md5(p.encode()).hexdigest()\n",
              "language": "python"
            },
            "bodyType": "json",
            "description": "language: python | javascript (how the snippet should be parsed); code: the source code to scan, as plain text",
            "method": "POST",
            "type": "http"
          },
          "output": {
            "example": {
              "counts": {
                "high": 1,
                "medium": 1
              },
              "engine": "rule-based-static (no LLM)",
              "findings": [
                {
                  "evidence": "API_KEY = 'sk-liv...b3c2'",
                  "fix": "move the value into an environment variable and rotate the credential",
                  "issue": "hardcoded credential",
                  "line": 2,
                  "rule": "hardcoded-secret",
                  "severity": "high"
                },
                {
                  "evidence": "",
                  "fix": "use sha256 or stronger (and a salt for passwords)",
                  "issue": "cryptographically weak hash",
                  "line": 4,
                  "rule": "weak-hash",
                  "severity": "medium"
                }
              ],
              "language": "python",
              "lines_scanned": 4,
              "risk": "high",
              "scope_note": "Static rule-based analysis. Not a formal audit and not a penetration test.",
              "total": 2
            },
            "type": "json"
          }
        },
        "schema": {
          "$schema": "https://json-schema.org/draft/2020-12/schema",
          "properties": {
            "input": {
              "additionalProperties": false,
              "properties": {
                "body": {
                  "type": "object"
                },
                "bodyType": {
                  "enum": [
                    "json",
                    "form-data",
                    "text"
                  ]
                },
                "description": {
                  "type": "string"
                },
                "method": {
                  "enum": [
                    "POST"
                  ],
                  "type": "string"
                },
                "type": {
                  "const": "http",
                  "type": "string"
                }
              },
              "required": [
                "type",
                "method"
              ],
              "type": "object"
            },
            "output": {
              "additionalProperties": false,
              "properties": {
                "example": {
                  "type": "object"
                },
                "type": {
                  "const": "json",
                  "type": "string"
                }
              },
              "required": [
                "type"
              ],
              "type": "object"
            }
          },
          "type": "object"
        }
      }
    }
  },
  "liveness": {
    "reliability": null
  },
  "verified": false,
  "featured": false,
  "provider": {
    "host": "fachada.chelsea-hermes.workers.dev",
    "manifest_name": "fachada.chelsea-hermes.workers.dev",
    "source": "cdp-mirror",
    "source_manifest_url": "https://api.cdp.coinbase.com/platform/v2/x402/discovery/resources",
    "submitted_at": "2026-10-13T15:56:53.641Z"
  },
  "exampleResponse": {
    "example": {},
    "type": "string"
  }
}