EyalSec

github.com/EyalSec

The open side of EyalSec

EyalSec follows untrusted data through your running program and reports when it reaches a SQL query, a shell command, a deserializer or a file path. This page lists everything around it you can read, run or fork today: two deliberately vulnerable demo apps, open-source tools that read your events, the live status page, and the guides.

Demo targets

Apps built to be attacked

Each one is insecure on purpose, so you can watch a real flow from the place untrusted data enters to the operation that uses it.

  • vulnerable-python

    A deliberately vulnerable Flask app. Each endpoint wires one source of untrusted data into one risky operation: SQL, shell commands, file paths, SSRF and more. Under your normal Python it is quietly exploitable; run the same unchanged file under es-python and every attack that reaches a sink is reported.

    Lab only. Run it on an isolated machine you control, never on the internet.

    • Python
    • MIT

  • vulnerable-javascript

    Northwind Retail Analytics, a deliberately vulnerable retail dashboard and the demonstration target for es-chromium. It carries 21 DOM-XSS flows across 8 sources and 18 sinks, each reachable from one URL, and every flaw sits inside a feature with a reason to exist. It is static, with no backend and nothing to steal.

    • JavaScript
    • MIT
    • Live on this domain

Open-source tools

Your events, where you already work

Keep the terminal, the CI and the assistant you rely on. These add EyalSec next to them through the EyalSec API and an API key from your dashboard. All MIT licensed.

  • eyalsec-cli

    List, search and export your events as CSV or JSON, show one event's full detail, and list your machines and runs, from a terminal, a cron job or a CI step. It only reads, so a read-only key is all it needs.

    brew install eyalsec/tap/eyalsec-cli
    • Go
    • MIT
    • Linux, macOS, Windows
    • .deb, .rpm, Homebrew

  • eyalsec-mcp

    Ask Claude, Cursor or any MCP client about your account in plain words, such as "what critical events came in since Monday?", and let the assistant you already use for code review help you triage. Read access to your events, machines, runs and rules.

    uvx eyalsec-mcp
    • Python
    • MIT
    • PyPI

  • es-python-action

    Run your test suite under es-python in GitHub Actions. Every injection flow your tests reach is summarised on the run's page, and the job fails at the severity you choose. One step, added after your dependencies install.

    - uses: EyalSec/es-python-action@v1
    • GitHub Action
    • MIT
    • Linux runners

  • homebrew-tap

    Homebrew formulae for EyalSec's open-source tools on macOS and Linux. Each formula installs the binaries from the tool's own release, and the tap's CI installs and tests every formula before you do.

    • Ruby
    • MIT

Status

Is it us?

The website, the dashboard and API, and the documentation are checked every five minutes, and every result is committed to a public repository you can audit.

WebsiteSee status page
Dashboard and APISee status page
DocumentationSee status page

From the latest check in EyalSec/status.

Products

What each one catches

The product pages on GitHub hold worked examples of what each one reports, and Discussions for your questions. Access starts with a live demo on your own code.

  • es-python

    The EyalSec Python runtime. Run your existing Django, Flask or FastAPI app through it unchanged, and it reports or blocks untrusted data reaching SQL queries, shell commands, deserializers, file paths and dynamic imports. Linux, x86_64 and aarch64, Python 3.9 to 3.14.

  • es-chromium

    The EyalSec browser for security testing. Browse the web app you are testing and it reports the DOM-XSS flows that really happened in the page: the source, the sink and the attacker-controlled characters. Built for penetration testers and AppSec teams. Linux x86_64.

Read

Guides and research

How to install, run and tune EyalSec, and write-ups on the injection classes it reports.

Community

Questions, reports and contributions

Thank you for every issue, question and fix. Here is where each one goes.