EyalSec is a secure Python that watches for harmful actions as your code runs, entirely on your own machine. Your source, your files and your data stay with you. Here is how the whole system is built to protect you.
A handful of rules guide the design, from the interpreter on your machine to the dashboard that shows your events.
EyalSec is built so your code and data stay local. The only thing that travels to your dashboard is the detection event itself.
It is the same Python you already use. The protection is off until you turn it on, and you choose whether it watches quietly or steps in.
Out of the box it behaves exactly like standard Python. You opt in to the protection you want.
It keeps track of data from risky sources and notices when that data reaches a sensitive operation.
In observe mode it reports the finding to your dashboard. In active mode it can stop the action before it runs.
No single control is trusted on its own. Each layer below assumes the others might fail.
Your code and files never leave the machine. Only detection events reach the dashboard.
Every connection is encrypted with modern TLS, and an access-control list can limit which addresses reach your dashboard and API.
Each machine carries its own credential. There is no shared master key in any binary, so one compromised machine never exposes the rest, and any credential can be revoked.
Dashboard sign-in supports optional two-factor auth, API keys are stored only as hashes, and every permission is enforced on the server, never just hidden in the page.
Passwords are stored with bcrypt, keys are kept as hashes, server secrets live in managed storage, and each machine’s configuration is encrypted just for it.
The interpreter we ship is stripped, checked for tampering, and built uniquely for every release, with no shared secret baked in.
Getting EyalSec onto a machine is itself part of the security model.
Each install uses a one-time, time-limited token tied to a specific machine and owner.
The interpreter is delivered over HTTPS and checked against a known checksum before it is unpacked.
Its unique credential is fitted at install time, so two machines never share an identity.
We welcome reports from security researchers acting in good faith. If you believe you have found a vulnerability, email security@eyalsec.com with the details and steps to reproduce.
Please give us a reasonable chance to investigate and fix the issue before disclosing it publicly. We will not pursue good-faith research conducted under our Acceptable Use Policy.