WebSecAuditor
AST Security EngineStatic AST Taint Analysis & Automated GitHub PR Security Bot
WebSecAuditor analyzes TypeScript, JavaScript, and Python codebases using Abstract Syntax Tree (AST) taint tracking. It detects hardcoded secrets, unsafe deserialization, SQL injections, and prototype pollution before malicious agent code is committed.
Key Capabilities
Full Dataflow Graph
Traces user-controlled inputs across function parameters, promise chains, and object destructuring into dangerous sinks (exec, eval, innerHTML, db.query).
Turnkey GitHub Action
Acts as an automated senior security engineer on pull requests. Comments directly with 1-click suggested diffs and blocks merges on critical CVSS violations.
Live Cloud Validation
Actively verifies discovered AWS, OpenAI, Stripe, and GitHub tokens with zero false positives before triggering instant webhook revocation.
GitHub PR Bot Action Preview
req.body.query to db.raw() in src/api/search.ts:44.knex.raw("SELECT * FROM items WHERE name = ?", [query]).