The problems es-python solves

You run Python in production, and the data people send it can be turned against you. This page starts from the problems teams like yours bring to us, one per section: your situation first, then what es-python does about it, with a link to the details.

Attacker data reaching a query, a command or a file

Each section below names a problem and the part of es-python that answers it. This first one is the problem es-python was built for.

Your situation. Your code builds SQL queries, shell commands, file paths and code from data that came from outside: a request, an uploaded file, a queue message. One missed check is enough for an attacker to read your database or run a command on your server, and the attack can look like ordinary input on the way in.

What es-python does. It marks that data as untrusted the moment it enters and follows it through your program, through copies, joins and decoding. When it reaches a dangerous operation, you get an event with where the data came in, where it was used and the call path between them. It judges where the text lands, not how it looks, so encoding it differently does not hide it.

That covers SQL injection, command injection, code injection, insecure deserialization, path traversal and SSRF. See How EyalSec works and Taint sources.

Flaws inside the frameworks and libraries you rely on

Most of the code your application runs was written by someone else, and es-python watches it the same way it watches yours.

Your situation. Django, Flask, FastAPI, database drivers and parsers do a great deal of work for you. A flaw in one of them is a flaw in your application, and until it is found and published, no advisory names it.

What es-python does. It watches the operation itself, whichever file it lives in, so a flow through a library is reported like a flow through your own code. That is how it surfaced the flows behind two SQL-injection flaws in Django itself, CVE-2024-42005 and CVE-2025-57833, which Django's security team fixed, with our thanks. The common database drivers come with es-python, so it sees the query text your program sends. See Packages and libraries.

Code your AI wrote, and what your AI does

AI now writes much of the code you run, and AI agents run programs on your machines.

Your situation. You cannot read every line an assistant writes, so you do not know which flaws came in with it. An agent runs commands and programs for you, and you do not always know what it ran.

What es-python does. It judges code by what it does while it runs, so a flaw is reported the same way whoever wrote it: untrusted data reaching a query, a command or a file is an event with the call path between them. The Python runs page lists every program es-python has run, on which machine, as which user and with its full command line, so you can see what an agent started. For apps that act on a model's answer, the Block LLM and AI agent abuse template stops that answer from becoming a command, code, a query or a call to an internal address.

Too many findings, too little time

A security team's time goes to confirming findings. es-python gives it findings that are already confirmed.

Your situation. Your team works through long queues of possible issues, and each one takes time to prove or dismiss before the real problems get attention.

What es-python does. Every event is a flow that actually happened, on real input, in your running program. A value your code made safe first, such as a parameterized query, is recognised and set aside as suppressed. Repeats fold into one event with a count (Unique event), rules hide what you have already reviewed, and labels, notes and saved searches keep the team's triage in one place.

Seeing an attack, and also stopping it

Knowing about an attack is good. Stopping it while it happens is better.

Your situation. A report that arrives after the query ran tells you what was taken. You want the option to stop it.

What es-python does. In Report and Raise mode it stops the dangerous operation: your program gets a RuntimeError at that point, and the event is still recorded. You choose which operations to block with a rule, after watching them in Report mode first. See Report and Raise.

Adding protection without risk to production

A security product is only useful if you can put it on the machines that matter.

Your situation. You cannot rewrite your code for a security product, and you cannot gamble with production.

What es-python does. Nothing in your code changes: you run your program with es-python instead of python, and your existing python stays installed. Report mode records only and does not change what your program does. You choose which sources to watch, and with few switched on most programs run close to their regular speed. Start on one machine, measure it on your own workload, then widen. See Install and Running es-python.

Abuse of your web application

Some attacks are about the request as a whole, not one value inside it.

Your situation. A single client floods your login page, known-bad addresses keep coming back, a forged host name steers your password-reset links, or a response leaks card numbers or ships without security headers.

What es-python does. Web protection runs those checks from inside your application: rate limits, blocked clients and auto-block, reports on ambiguous requests, reflected input, open redirects, forged host names, card numbers in responses and missing security headers, and it can add the missing headers for you. It works with Django, Flask, FastAPI and other Starlette applications, and aiohttp, and every check is off until you switch it on.

Your server being steered to call somewhere it should not

Server-side request forgery turns your server into the attacker's messenger.

Your situation. Untrusted input can make your program call an internal service or the cloud metadata address, or a compromised dependency can call out to an address you never meant it to reach.

What es-python does. The Outbound connections policy decides which addresses and URLs your programs may connect to. A denied connection fails inside your program and is recorded as an event.

Secrets in your code and in your events

Credentials are among the first things an attacker looks for.

Your situation. Keys and passwords end up written into source code, and secrets in environment variables or command lines can travel into logs and reports.

What es-python does. The hardcoded source finds credentials written into your source code and reports where they are used. Values that look like secrets are masked on the machine before an event is sent, and again when it arrives. Your source code stays on the machine by default: an event carries the operation, the call path and the data that triggered it.

Findings in the tools your team already uses

Your team already has a place where security work happens. EyalSec's events go there.

Your situation. Your SIEM, your code scanning view and your own scripts are where your team searches, alerts and reports.

What es-python does. Event forwarding streams events to your SIEM as they arrive, signed, with ready recipes for Microsoft Sentinel, Google Security Operations, Splunk, Elastic and Datadog. You can export events as CSV, JSON or SARIF, send them to GitHub code scanning, and automate everything through the API.

Catching it before release

The cheapest flaw to fix is the one that never ships.

Your situation. You want a flow from untrusted data to a dangerous operation to stop the build, not reach production.

What es-python does. It runs your test suite in CI on GitHub Actions or GitLab CI and fails the job when the run reports anything at or above the severity you choose. It also fits in your containers.

Many machines, many settings

Protection has to be easy to manage once there is more than one server.

Your situation. You run many services on many machines, each needing slightly different settings, and you need to know what is actually running where.

What es-python does. The Machines map groups machines into zones and applies policies to a whole group at once. Rule templates, including ready-made ones that block attacks or keep your list quiet, set a machine up in one step, and each machine can still be configured on its own. The Python runs page shows every program es-python has run, on which machine and as which user.

Your Python, as it is

es-python fits the environment you already have.

Your situation. Your services run on different Python versions, with their own packages, virtual environments and frameworks.

What es-python does. It runs Python 3.9, 3.10, 3.11, 3.12, 3.13 and 3.14 on Linux, x86_64 and aarch64, with several versions side by side on one host. Your installed packages and virtual environments keep working, and it runs web applications, background workers and plain scripts alike.

Access control, audit and procurement

A security product has to meet the same bar it helps you meet.

Your situation. Your security review asks who can sign in, how access is controlled, what is recorded, how downloads are verified and how data is handled.

What es-python does. The dashboard supports single sign-on with Okta, Microsoft Entra ID and other providers (and can make SSO the only way in), two-factor authentication, session controls and an activity log. Every agent download is signed, and you can verify it with OpenSSL. The DPA, privacy policy, security measures and sub-processor list are published.

Paying for what you use

You should pay for the protection you run, and nothing else.

Your situation. You want a price that follows the size of what you protect.

What es-python does. It is priced per machine, for the hours the machine is on, so a machine you need for a day costs a day. Book a live demo and we quote your own numbers.

See it on your own code

The fastest way to see which of these problems es-python answers for you is to watch it run on your code.

See how EyalSec helps you, or read the Quick start to see the steps from a new account to the first event.