Secure Code Review Toy
Paste a code snippet and get flagged patterns — eval, string-built SQL, hardcoded secrets. Not a real SAST tool, but trains the eye.
Secure code review is pattern recognition before it is anything else. Certain shapes — string-built queries, unvalidated redirects, hardcoded secrets — are worth a second look every time. This page flags a set of them in whatever you paste, so you can practise spotting the shapes.
How to use it
- Paste a code snippet in any language.
- Press Scan.
- Read each flagged pattern and why it is risky.
What to take away
Follow the untrusted input
Real review is a data-flow question: where does user input enter, and what does it reach? A dangerous function fed only by constants is not a bug.
Pattern matching finds shapes, not bugs
This is a teaching toy, not a static analyser. It will miss real flaws and flag safe code — which is also true of expensive commercial scanners, just less obviously.
Hardcoded secrets are the highest-value find
They are common, unambiguous, and immediately exploitable. The Leaked Secret Hunt lab is built entirely around this one class.
Frequently asked questions
Can this replace a real SAST tool?
No. It has no parser, no data-flow analysis and no rule set worth the name. It exists to train your eye for the patterns that deserve attention.
What should I look for first in unfamiliar code?
Where input arrives, where queries are built, where files and URLs are opened, where authorisation is checked — and whether that last one happens at all.
Is my code sent anywhere?
No. The scan runs in your browser and nothing is uploaded.
Where this fits in the course
This security tool pairs with Path 22 — DevSecOps & AppSec — see all 26 learning paths.
It runs entirely in your browser: nothing is uploaded, no account is needed, and it is free.
Related
- Dependency / SBOM Risk Checker — Paste a dependency list and flag ones matching a known-vulnerable version range.
- Leaked Secret Hunt — A public GitHub repo dump. Find the hardcoded API key an automated scanner would catch in minutes — before an attacker does.
- Regex Tester — Test a regular expression against sample text with live match highlighting and capture groups.
- STRIDE Threat-Model Worksheet — A guided Spoofing/Tampering/Repudiation/Info-Disclosure/DoS/Elevation worksheet, exportable as Markdown.