# EyalSec

> EyalSec is a secure Python. You install its runtime, es-python,
> next to your normal Python and run your programs through it unchanged. As
> your code runs, es-python watches for untrusted data (from network sockets,
> files, standard input, environment variables and command-line arguments, or
> code another user can write) reaching a risky action (a shell command, a
> file open, a database query, deserialization). When it does, EyalSec either
> reports it to your dashboard, or reports and blocks it before it runs. That
> untrusted-data-reaches-a-sink pattern is how most real-world attacks work: SQL
> injection, command injection, path traversal, insecure deserialization.
> es-python is EyalSec secure Python, so your code and your libraries stay exactly
> the same.

## What it is

- es-python is EyalSec secure Python with runtime taint tracking built in; your code is unchanged.
- Two modes, chosen per machine: Report (log the event to your dashboard) or Report and Raise (log it and also stop the action, raising a RuntimeError instead).
- Managed from a web dashboard; a JSON API mirrors everything the dashboard does.
- Detects injection classes as they actually execute at runtime, not by scanning source. It has already flagged two critical CVEs in Django.

## What EyalSec finds that other tools can't

EyalSec is unique: no one else does what we do. It taints the untrusted data itself and follows that mark through every transform to the exact call that runs it, so it catches attacks that whole categories of tools structurally cannot see.

- RASP hooks the app to match request payloads against dangerous calls, but loses the input once it is split, sliced, or rejoined. es-python follows the taint through every string transform to the sink.
- WAF / edge pattern-matches malicious HTTP at the network boundary, but misses injection that never rides HTTP, such as a file or queue feed. es-python taints every input channel, not just the HTTP edge.
- SAST statically scans source for risky patterns, but cannot tell which flagged path is really exploitable. es-python fires only when live taint reaches a sink.
- DAST / fuzzing probes a running app from outside, but misses sinks on branches it never reaches, and a successful injection that never crashes. es-python flags the injection semantically, with no crash required.
- SCA / dependency flags known-CVE dependencies, but misses unknown vulns and cannot confirm a CVE is truly reachable. es-python confirms attacker data actually reaches the vulnerable code.
- Sandboxing / isolation restricts syscalls or isolates the process, but sees only syscalls, not app-level injection. es-python tracks app-level taint to the sink and gates only the tainted call, leaving the clean one alone.
- EDR / runtime threat detects malicious behavior at the OS or host level after it happens. es-python raises before the payload executes, so there is no behavior left for the EDR to observe.

No one else does this: EyalSec is the only tool that follows tainted data all the way to the sink inside real Python execution, so it catches the exploit the others cannot.

## Pages

- [Home](https://eyalsec.com/): what EyalSec does, the two modes, and how it installs.
- [Documentation](https://eyalsec.com/docs): install es-python, run your code through the taint engine, read events, and configure rules.
- [Pricing](https://eyalsec.com/pricing): size machines and monthly events for an instant price.
- [Security](https://eyalsec.com/security): the security model. Your source code never leaves your machine.
- [Contact](https://eyalsec.com/contact): sales, support, and security disclosures.

## Documentation pages

- [What is EyalSec?](https://eyalsec.com/docs/what-is-eyalsec): EyalSec watches your programs while they run and tells you when data from the outside world reaches a risky action.
- [How EyalSec works](https://eyalsec.com/docs/how-it-works): This page explains the four ideas behind every EyalSec product: untrusted data, sources, sinks and events.
- [Quick start](https://eyalsec.com/docs/quick-start): This page takes you from no account to your first event with es-python, in about ten minutes. Each step is short and links to the page that explains it in full.
- [Products](https://eyalsec.com/docs/products): EyalSec comes as two products: es-python, which watches Python programs, and es-chromium, which watches web pages.
- [Create an account](https://eyalsec.com/docs/register): This page explains how to create an EyalSec account, verify your email address, accept an invitation, and what a new account can do before a plan is set up.
- [Sign in and sign out](https://eyalsec.com/docs/sign-in): This page explains how to sign in with your username and password or with Google, what the two-factor step at sign-in looks like, what happens after too many...
- [Forgot password](https://eyalsec.com/docs/forgot-password): This page explains how to reset a forgotten password with a code sent to your email, and the rules every EyalSec password must follow.
- [Settings](https://eyalsec.com/docs/settings): This page explains the Settings pages, where you manage your own account, and covers the recovery email, the display time zone, and why some changes ask for...
- [Password and sessions](https://eyalsec.com/docs/sessions): This page explains how to change your password from Settings and how to choose how long you stay signed in without using the dashboard.
- [Two-factor authentication](https://eyalsec.com/docs/two-factor): This page explains how to protect your account with a second step at sign-in: an authenticator app, one-time backup codes, and codes sent by email.
- [API keys](https://eyalsec.com/docs/api-keys): This page explains how to create, view, replace and revoke the API key that lets your own scripts and tools use the EyalSec API without signing in through the...
- [Delete your account](https://eyalsec.com/docs/delete-account): This page explains the Danger zone page in Settings and what happens when you permanently delete your EyalSec account.
- [Plans and limits](https://eyalsec.com/docs/plans): This page explains what your EyalSec plan sets: which products you have, how many machines you can add, how many events each list shows, and whether you can...
- [Machines](https://eyalsec.com/docs/machines): What a machine is, how the Machines page lists your machines, what each status means and what the badges on a machine's row tell you.
- [Add a machine](https://eyalsec.com/docs/add-machine): How to add a machine on the Machines page: choosing the product, naming the machine, and for es-python picking its distribution, architecture and Python...
- [Install es-python on a machine](https://eyalsec.com/docs/install): How to get an es-python machine's install command, run it on the host, what it installs and where, and what to do when an install does not finish.
- [Install es-chromium](https://eyalsec.com/docs/install-other-products): How to install es-chromium, the EyalSec browser, on a PC.
- [Manage machines](https://eyalsec.com/docs/manage-machines): How to look after a machine once it exists: setting a missing OS, renaming, reinstalling to take a newer build, configuring what it watches, uninstalling...
- [Configure a machine](https://eyalsec.com/docs/configure): The Configure window is where you choose what a machine watches for and what happens to the events it finds.
- [Taint sources](https://eyalsec.com/docs/taint-sources): A taint source is a place where untrusted data can enter a program, such as the network, a file or the command line.
- [Event context](https://eyalsec.com/docs/event-context): An es-python machine can attach extra context to every event it reports: the command line, the environment variables and short listings of your source code.
- [Rules](https://eyalsec.com/docs/rules): A rule decides what happens to a group of events: show only them, hide them, stop the machine sending them, or block the risky operation.
- [Report and Raise](https://eyalsec.com/docs/report-and-raise): EyalSec can respond to a detection in two ways: Report records it and lets the program carry on, while Report and Raise also blocks the risky operation.
- [Unique event](https://eyalsec.com/docs/unique-event): The Unique event setting decides when a new detection opens a new row in your events list and when it only adds to the count of an existing one.
- [Events](https://eyalsec.com/docs/events): The Events page lists everything EyalSec has detected on your machines, one list per product, newest first.
- [Event detail](https://eyalsec.com/docs/event-detail): Clicking an event opens it in place and shows the full story: what happened, why it matters, what to do, and the evidence behind it.
- [Filtering events](https://eyalsec.com/docs/filtering): The toolbar above each events list narrows what you see: by time, machine, severity, source, label, tag and more.
- [Advanced search](https://eyalsec.com/docs/advanced-search): The Advanced search panel under the events toolbar holds the time range, the scope, the condition builder and your saved searches.
- [Suppressed events](https://eyalsec.com/docs/suppressed-events): EyalSec hides events it can prove are harmless, without deleting them. This page explains what suppression is, how to see suppressed events, and how it affects...
- [Triage](https://eyalsec.com/docs/triage): Triage is working through your events: marking what you have looked at, writing down what you decided, and hiding what you do not need to see again.
- [Saved searches](https://eyalsec.com/docs/saved-searches): A saved search stores the whole state of an events list under a name, so you can come back to it in one click.
- [Runs](https://eyalsec.com/docs/runs): A run is one start of a program under es-python, from launch to exit. This page explains runs, how to narrow the events list to a single run with the run...
- [Events map](https://eyalsec.com/docs/events-map): The Map layout draws your es-python events as a picture: where the untrusted data came from, which files it was read from, and which sinks it reached.
- [Exporting events](https://eyalsec.com/docs/export): You can download your events as a CSV or JSON file through the EyalSec API. This page explains how, and how to export exactly what the events page shows.
- [Filters](https://eyalsec.com/docs/filters): The Filters page holds the standing settings for one product: the taint sources and rules that apply to every machine, what you have blocked from view, and...
- [Rule templates](https://eyalsec.com/docs/rule-templates): A rule template is a named set of rules you can copy into your global rules or into one machine in a single step.
- [Dashboard](https://eyalsec.com/docs/dashboard): What each card and panel on the dashboard shows, how the numbers are counted, and what to do when the dashboard is empty.
- [Activity log](https://eyalsec.com/docs/activity-log): What the Activity page records, what each column means, how to filter it and load older entries, and how long entries are kept.
- [Running es-python](https://eyalsec.com/docs/running-es-python): How to run your Python programs under es-python once a machine is installed, where it lives on disk, how Python versions sit side by side, and what to do when...
- [es-python command line](https://eyalsec.com/docs/es-python-cli): Every EyalSec option you can give es-python on the command line, and the environment variable that does the same thing, in one reference.
- [Packages and libraries](https://eyalsec.com/docs/packages): How es-python finds your installed Python packages, how to install new ones, and which copy of a library your program imports when es-python bundles its own.
- [On the machine](https://eyalsec.com/docs/on-machine): What the es-python installer leaves on your computer besides the runtime: the on-machine manual, the build records, the eyalsec helper command, and a context...
- [es-chromium](https://eyalsec.com/docs/es-chromium): es-chromium is the EyalSec browser: you browse the site you are testing with it, and it reports when data an attacker can influence reaches a part of the page...
- [API overview](https://eyalsec.com/docs/api): The EyalSec API lets a script do what you do in the dashboard: read your events, machines and activity, and change your machines, rules and settings.
- [Events API](https://eyalsec.com/docs/api-events): These endpoints read your events: the filtered list, one event's full detail, the runs that produced them, counts and statistics, exports, the es-python map,...
- [Machines API](https://eyalsec.com/docs/api-machines): These endpoints list your machines and do what the Machines page does: add, rename and delete machines, set their OS, and get their install and uninstall...
- [Filters, rules and taint API](https://eyalsec.com/docs/api-rules): These endpoints manage what the dashboard shows and what your machines watch: event filters, machine rules, taint source settings, and the definition of what...
- [Rule templates API](https://eyalsec.com/docs/api-templates): These endpoints list, create, change and apply rule templates, and save a scope's current rules as a new template.
- [Labels and notes API](https://eyalsec.com/docs/api-labels): These endpoints manage your triage labels, attach them to events, and write your note on an event.
- [Activity and account API](https://eyalsec.com/docs/api-account): These endpoints read your activity log and manage your own account: profile, time zone, recovery email, password, two-factor sign-in and API key.
- [Agent endpoints](https://eyalsec.com/docs/api-agents): These are the endpoints the EyalSec agents on your machines call by themselves: to report events, to fetch their configuration, and to install.
- [Glossary](https://eyalsec.com/docs/glossary): Short definitions of every term you meet in the EyalSec dashboard and this guide, in alphabetical order, each with a link to the page that explains it fully.
- [FAQ](https://eyalsec.com/docs/faq): Short answers to the questions people ask most, each with a link to the page that has the details.
- [Troubleshooting](https://eyalsec.com/docs/troubleshooting): Find the symptom you are seeing and follow the steps under it, from the most common cause to the least.
- [Getting help](https://eyalsec.com/docs/help): How to reach EyalSec for support or for changes to your plan, and what to include so we can help quickly.

## Key facts

- Sources (where untrusted data enters): network sockets, files, standard input, environment variables and command-line arguments, and foreign code (Python on disk another user can write to).
- Sinks (risky actions it watches): running a system command, opening a file, running a database query, deserialization, and more.
- Privacy: your source code and files never leave the machine. Only the detection event is sent to the dashboard (the sink that fired, a stack trace, where the data came from, and the data that triggered it).
- Three pieces work together: the es-python runtime, the web dashboard, and the JSON API.