// tool reference · Vulnerability & Assessment

Security Code Review Assistant Free

防御用の SAST：貼り付けたコードの脆弱性と修正方法を見つけます。

What it does

Paste a snippet and get vulnerabilities identified with CWE IDs and a corrected rewrite. Built for the review moment, not for a full codebase.

When to use it

Reviewing a PR; checking a pattern you are unsure about; learning why something is unsafe.

Inputs

Field names are the actual form parameters, verified against source.

Field	種類	Required	Notes
code	textarea	required	The snippet.
lang	select	任意	Language hint.

What you get back

Findings with CWE ID, severity, an explanation, and the fixed code.

活用例

Input

$q = "SELECT * FROM users WHERE id = " . $_GET['id'];
$r = $db->query($q);

Output (abridged)

CRITICAL  CWE-89 SQL Injection
          $_GET['id'] is concatenated into SQL. ?id=1 OR 1=1 returns every
          row; ?id=1; DROP TABLE users-- may execute if multi-statement is on.

FIX
  $st = $db->prepare('SELECT * FROM users WHERE id = ?');
  $st->execute([(int)$_GET['id']]);
  $r = $st->fetchAll();

Also set PDO::ATTR_EMULATE_PREPARES => false so these are true
server-side prepares rather than client-side interpolation.

How it works

AI review against a security-focused prompt. Advisory — no code is executed.

Limits

Read live from the platform configuration.

Rate limit

6 requests / 10 minutes

Limitations — what it does なし do

It sees a snippet, not the program. It cannot know your framework's escaping, your callers, or your sanitisation upstream -- so expect both false positives and blind spots. It reviews; it does not assure.

プライバシー

Your snippet is sent to the AI provider. Do not paste secrets.

Standards

CWEOWASP Top 10