We watch what your program does with the data it was given.
You already have tools that read your code and tools that guard the edge of your network. EyalSec adds one more view: the moment, inside the running program, when data from outside reaches a query, a command or a file. We are a small, founder-led company in Petah Tikva, Israel, and we make two products that report that moment.
Company
EyalSec
Founder
Eyal Gabay, Founder and CEO
Based in
Petah Tikva, Israel
Products
es-python and es-chromium
what the products observe
Where the data came in, and where it was used
es-python
The EyalSec Python runtime. Your existing Python code runs on it unchanged.
Data that came in from
network requests
files the program reads
standard input
environment variables
command-line arguments
files other users can change
Reported when it reaches
a SQL query
a shell command
code evaluation
deserialization
a file path
a dynamic import or an outbound URL
Each event shows the operation, the line of code that performed it, the value it received and where the untrusted part came from. In Report mode es-python records the flow; in Report and Raise it also stops that operation with an error.
The EyalSec browser, for security testing of web pages. It runs on Linux x86_64.
Page input from
the address of the page
messages from other windows
responses the page fetched
web storage and cookies
form input
Reported when it reaches
a markup write
a call that runs code
a script URL or an attribute
a navigation
Each event is a DOM-based cross-site scripting flow that really happened in a page you visited, from the input to the place that used it. It also reports weaknesses in the page itself, such as a missing Content-Security-Policy or a cookie without Secure.
We look at the operation the program actually performs: the query, the command, the write. Not a copy of the traffic on the way in, so there is nothing in between for an attacker to encode around.
Evidence
A finding is a flow that really happened on real input, with the path from where the data entered to where it was used. Not a pattern match, and not a guess.
And the limit we state plainly: an event shows that untrusted data reached an operation. Whether that flow can be exploited is a judgment the event's trace lets you make, because code earlier in the program may have pinned the value.
who we are
Founder-led, and early
EyalSec was founded by Eyal Gabay, who leads it as Founder and CEO. es-python surfaced flows of untrusted data into the SQL that Django builds. He confirmed two of them as vulnerabilities, reduced each to a report and sent them to Django's security team, who fixed both and credited him in each advisory. We are grateful to them for how they handled both reports.
We are early. There are no public customer names, case studies or usage numbers yet, and no page on this site will pretend otherwise. Pricing is published on the pricing page, and how we handle your data is on the security page.
CVE-2024-42005
SQL injection in Django's QuerySet.values() and values_list(), fixed in Django 5.0.8 and 4.2.15. Django's advisory
CVE-2025-57833
SQL injection through FilteredRelation column aliases, fixed in Django 5.2.6, 5.1.12 and 4.2.24. Django's advisory
TodayTwo products
es-python for Python 3.9 to 3.14 on Linux, x86_64 and aarch64, and es-chromium for Linux x86_64. What changed lately is on the changelog.
the details
The facts, for the record
Legal form
Eyal Gabay, trading as EyalSec, a sole proprietor registered in Israel. The terms carry the registration details.
Hosting
The dashboard runs on Amazon Web Services in the il-central-1 (Israel) region. es-python and es-chromium run on your own machines. See the security measures and sub-processors.
Certifications
None yet: EyalSec holds no SOC 2 or ISO 27001 certificate. The security measures we do take are published.
Pricing
Metered per machine and per detection, with no free tier and no trial. Size it on the pricing page.