EyalSec makes es-python, the EyalSec Python runtime. It follows attacker-controlled data through a running Python application to the operation where it would become an exploit, such as a SQL query, and reports or stops the flow. Founder Eyal Gabay is credited in Django's advisories for two severe SQL-injection CVEs. eyalsec.com
// PRESS KIT
Writing about EyalSec? Start here.
The boilerplate, the facts, the founder, the logos and the colours, ready to use as written. If something you need is not here, or you would like to talk to the founder, write to us and a person will reply, usually within one business day.
Press contact
sales@eyalsec.com
For interviews, questions and dashboard screenshots from a demo account.
About EyalSec, in 50 and 100 words
EyalSec makes es-python, the EyalSec Python runtime. Existing Django, Flask and FastAPI applications run through it unchanged, and it follows attacker-controlled data from where it entered to the operation that would be exploited: a database query, a shell command, a deserializer, a file path or a dynamic import. It records each flow on the EyalSec dashboard (Report) or stops it at that operation (Report and Raise). Founder Eyal Gabay is credited in Django's advisories for two severe SQL-injection vulnerabilities, CVE-2024-42005 and CVE-2025-57833. EyalSec also makes es-chromium, a browser for security testing. EyalSec is based in Israel. eyalsec.com
The facts
- Company
- EyalSec
- Legal form
- Eyal Gabay, trading as EyalSec, a sole proprietor registered in Israel (terms)
- Founder
- Eyal Gabay, Founder and CEO
- Location
- Petah Tikva, Israel
- Stage
- Early stage and founder-led. No public customers yet.
- Website
- eyalsec.com
- Documentation
- eyalsec.com/docs
- Research
- eyalsec.com/research, with an Atom feed
- What is new
- eyalsec.com/changelog, with an Atom feed
- Pricing
- Metered per machine and per detection; no seats, no minimum, no free tier and no trial (eyalsec.com/pricing)
- Demo
- Book a live demo at eyalsec.com/contact
- Security reports
- security@eyalsec.com
- Elsewhere
- GitHub, X, LinkedIn
The two products, in one line each
es-python
The EyalSec Python runtime: it runs your existing Python code unchanged and reports untrusted data reaching a SQL query, a shell command, deserialization, a file path or a dynamic import.
Python 3.9 to 3.14 on Linux, x86_64 and aarch64. Two modes: Report records each flow on the dashboard and changes nothing about how the program runs; Report and Raise also stops the operation with an error.
es-chromium
The EyalSec browser for security testing: it reports the DOM-based cross-site scripting flows that really happened in the pages you visit, from the input to the place that used it.
A desktop browser for Linux x86_64, for pentesters and application security teams.
The Django CVEs, worded the way we word them
Founder Eyal Gabay reported two severe SQL-injection vulnerabilities in Django: CVE-2024-42005 (CVSS 7.3 High per NVD; CISA rates it 9.8 Critical) and CVE-2025-57833 (CVSS 8.1 High per NVD). es-python surfaced the flows of untrusted data into the query; he confirmed each bug and reported it to Django's security team, who fixed both.
Django's advisories: 6 August 2024 and 3 September 2025. Please quote the scores with their source, as above.
The founder
Eyal Gabay
Founder and CEO, EyalSec
Eyal Gabay is the founder and CEO of EyalSec. He reported two SQL-injection vulnerabilities in Django, CVE-2024-42005 and CVE-2025-57833, and Django's security advisories credit him for both. He leads EyalSec, which is based in Petah Tikva, Israel.
Logos, for light and dark
Download all logos (zip)
Please keep clear space around the logo of at least the bar's width, and do not recolour, stretch or add effects.
The palette and the typefaces
- #111310
- #181a15
- #f2f1ea
- #b6b8ad
- #e8b04b
- #d64545
- Space GroteskHeadings and the wordmark (weight 600)
- IBM Plex SansBody text
- IBM Plex MonoLabels, code and data
How to write the names
- EyalSec is one word, with a capital E and a capital S.
- es-python and es-chromium are written in lower case with a hyphen, also at the start of a sentence.
- es-python is the EyalSec Python runtime; es-chromium is the EyalSec browser.
- The two modes are Report and Report and Raise.
- Python is a trademark of the Python Software Foundation. EyalSec is not affiliated with or endorsed by the PSF.