Code map
Where the data comes from, which functions it goes through and where it ends up. Problems sit in the function where they appear; pick one to keep only its path.
Pick a problem
The map then keeps only its path: the entry point the data comes from, the functions it goes through and the place where it ends up.
Stripe secret key in the code
3const stripe = new Stripe("sk_l****")
- Problem hereconst stripe = new Stripe("sk_l****"), src/lib/stripe.ts:3
With this key, anyone can create payments and refunds and read your customers.
Revoke the key in the Stripe dashboard, then read it from a server-side environment variable.
Supabase table without RLS
1create table orders (id uuid primary key, items jsonb, email text);
- Problem herecreate table orders (id uuid primary key, items jsonb, email text);, supabase/migrations/003_orders.sql:1
- UsesDatabase
Without Row Level Security, your app's public anon key is enough to read and change the whole table.
Add “alter table … enable row level security;” then rules that restrict each row to its owner (auth.uid()).
RLS turned off on a table
2alter table orders disable row level security;
- Problem herealter table orders disable row level security;, supabase/migrations/003_orders.sql:2
- UsesDatabase
The table becomes readable and writable by everyone with the anon key again.
Delete this line and turn RLS on with per-user rules.
SQL query built from user text
4const res = await pool.query(`SELECT * FROM products WHERE name LIKE '%${q}%'`)
- Entry pointGET /api/search (query: q)
- Goes throughGET(request), src/app/api/search/route.ts:3
- Problem heresearchProducts(q), src/lib/products.ts:4
- UsesDatabase
If a value comes from the user, they can read or wipe the database (SQL injection).
Use parameters (%s, ?, $1) or the ORM instead of pasting values into the query.
Map built by reading the code (Python, JavaScript and TypeScript) without running it: a dynamic call or a decorator can slip through. Only the names of functions and routes and the line numbers are kept.
With this key, anyone can create payments and refunds and read your customers.
Revoke the key in the Stripe dashboard, then read it from a server-side environment variable.
1 place in the code
src/lib/stripe.ts:3const stripe = new Stripe("sk_l****")
See the prompt
In src/lib/stripe.ts:3: Stripe secret key in the code. Revoke the key in the Stripe dashboard, then read it from a server-side environment variable. Fix only these places, then explain the change to me.
Without Row Level Security, your app's public anon key is enough to read and change the whole table.
Add “alter table … enable row level security;” then rules that restrict each row to its owner (auth.uid()).
1 place in the code
supabase/migrations/003_orders.sql:1create table orders (id uuid primary key, items jsonb, email text);
See the prompt
In supabase/migrations/003_orders.sql:1: Supabase table without RLS. Add “alter table … enable row level security;” then rules that restrict each row to its owner (auth.uid()). Fix only these places, then explain the change to me.
The table becomes readable and writable by everyone with the anon key again.
Delete this line and turn RLS on with per-user rules.
1 place in the code
supabase/migrations/003_orders.sql:2alter table orders disable row level security;
See the prompt
In supabase/migrations/003_orders.sql:2: RLS turned off on a table. Delete this line and turn RLS on with per-user rules. Fix only these places, then explain the change to me.
If a value comes from the user, they can read or wipe the database (SQL injection).
Use parameters (%s, ?, $1) or the ORM instead of pasting values into the query.
1 place in the code
src/lib/products.ts:4const res = await pool.query(`SELECT * FROM products WHERE name LIKE '%${q}%'`)Data sent by the user in src/app/api/search/route.ts:4, passed on by searchProducts (src/app/api/search/route.ts:5), used here without checking.
See the prompt
In src/lib/products.ts:4: SQL query built from user text. Use parameters (%s, ?, $1) or the ORM instead of pasting values into the query. Fix only these places, then explain the change to me.
What the code analysis checks
Keys and passwords written in the code (Stripe, AWS, GitHub, GitLab, OpenAI, Anthropic, Hugging Face, SendGrid, Slack, Telegram, Google, npm and PyPI tokens, database addresses with a password, private keys, .env files), the application secret key hard-coded, secrets exposed to the browser (NEXT_PUBLIC_, VITE_…), the Supabase service_role key in the browser, Supabase tables without RLS or with open policies (across all the project's migrations), Firebase rules that are open or in “test mode”, Supabase views and functions that bypass RLS, SQL queries and system commands built from text, requests, files and redirects chosen by the user (also when the value goes through a variable a few lines earlier), data saved without choosing the fields, data loading that can run code, passwords hashed with MD5 or compared to a fixed value, weakened CSRF protection or session cookies, tokens in localStorage or drawn with Math.random, debug mode on, TLS or JWT verification turned off, CORS open with credentials and HTML inserted without sanitising. Example values (your-key, xxxx), default local passwords, comments, tests and test configurations are not reported, except for secrets.
In a project, the analysis also notes which packages are imported in the code: a vulnerability in a package that the code never imports, and that no other package needs according to the lockfile, goes down one level, with the reason. Dependency files found (package-lock.json, requirements.txt, composer.lock…) directly give a new version of the dependency analysis.
The code is read in memory and then forgotten: Tamiso keeps only the file name, the line and a short excerpt with secrets masked. Dependency and build folders (node_modules, dist…) are skipped. A rule-based analysis does not replace a security review.
How it works
Rules for common mistakes
Secrets, Supabase and Firebase, SQL injections, open redirects, debug mode left on. Each rule has its CWE identifier and a one-sentence fix.
The code map
Where data comes from (routes, scripts), which functions it goes through and where it ends up: database, e-mails, files, external services. Each problem is placed on its path.
The code is not kept
The archive is read in memory, then forgotten. Tamiso keeps the file, the line, the rule and a short excerpt with the secret masked.