code scan derived

{
  "input": {
    "body": {
      "code": "import hashlib\nAPI_KEY = 'sk-live-9f2b7c41a8de5f60b3c2'\ndef h(p):\n    return hashlib.md5(p.encode()).hexdigest()\n",
      "language": "python"
    },
    "type": "http",
    "method": "POST",
    "bodyType": "json",
    "description": "language: python | javascript (how the snippet should be parsed); code: the source code to scan, as plain text"
  },
  "output": {
    "type": "json",
    "example": {
      "risk": "high",
      "total": 2,
      "counts": {
        "high": 1,
        "medium": 1
      },
      "engine": "rule-based-static (no LLM)",
      "findings": [
        {
          "fix": "move the value into an environment variable and rotate the credential",
          "line": 2,
          "rule": "hardcoded-secret",
          "issue": "hardcoded credential",
          "evidence": "API_KEY = 'sk-liv...b3c2'",
          "severity": "high"
        },
        {
          "fix": "use sha256 or stronger (and a salt for passwords)",
          "line": 4,
          "rule": "weak-hash",
          "issue": "cryptographically weak hash",
          "evidence": "",
          "severity": "medium"
        }
      ],
      "language": "python",
      "scope_note": "Static rule-based analysis. Not a formal audit and not a penetration test.",
      "lines_scanned": 4
    }
  }
}