jev-attack-surface-analysis

The README opens with

Maps the attack surface of a backend codebase and flags likely vulnerabilities, down to the suspicious line, for about one cent per repo.

Try it without installing anything: https://franciscocarloserra.github.io/jev-attack-surface-analysis/ (read-only results on PyGoat and NodeGoat).

You give it a repo (Python, JavaScript or TypeScript) and a budget in dollars. You get:

- a map of the codebase, one block per file, colored by how suspicious it is; - a ranked list of potential vulnerabilities, each pointing to the exact line (e.g. user input reaching SQL, eval, a shell or an outbound request); - a copy button (or printissues.py) that hands that list to an AI agent, with the instruction to validate each issue, not to fix it.