Worked example

A bad webhook fails. The repair passes.

The same task was checked twice: first with unsafe code, then with the corrected version.

Demonstration, not a customer result. You can reproduce it locally with the current fixed-rule evaluator.

01 / first check

Unsafe input execution

FAIL

def handle_webhook(payload: str, signature: str) -> dict:
    if not signature:
        raise ValueError("missing signature")
    event = eval(payload)
    return {"accepted": True, "event": event}

Critical · confidence 0.92

Dynamic code execution is unsafe

The code calls eval, which can execute attacker-controlled input.

Repair: Replace dynamic execution with explicit parsing or a safe dispatch table.

Verify: Add a security test proving untrusted input is not executed.

High · confidence 0.80

Declared constraint ignored

The code violates the stated rule against dynamic execution on untrusted input.

Repair: Correct the code, then run the evaluation again.

02 / second check

Authenticated JSON parsing

PASS

expected = hmac.new(
    secret,
    payload.encode("utf-8"),
    hashlib.sha256,
).hexdigest()
if not hmac.compare_digest(signature, expected):
    raise ValueError("invalid signature")
event = json.loads(payload)
if not isinstance(event, dict):
    raise ValueError("event must be a JSON object")

Verified second check

No material issues detected

The repaired code returned pass with zero findings under the same task, requirements, constraints, and code_review profile.

Run IDs: eval_66e35f9bd5a7 → eval_9db0cdda68c4

Content hashes: bc55210a00bd… → 68e90c0f619f…

Machine handoff

The response can drive the next step.

{
  "overall": { "verdict": "fail", "confidence": 0.86 },
  "findings": [{
    "severity": "critical",
    "evidence": { "location": "ast.Call", "observed_value": "eval/exec" },
    "recommended_fix": "Replace dynamic execution with explicit parsing or a safe dispatch table.",
    "verification": "Add a security test proving untrusted input is not executed."
  }]
}

What happened

TUC caught the use of eval, tied it to the stated constraint, suggested a fix, and passed the corrected code on a second evaluation.

Limit

This example covers one known unsafe pattern. It is not a security certification and does not show that every defect will be found.

Want to try your own work?
Run the free preview or connect the API.

Run free preview Get access — $249