Self-Service Live Playground • Zero Setup Required

Try DevGuard AI Live

This runs our real AI agent — it actually calls a linter, a vulnerability scanner, and can run tests, then an LLM reviews the results. Nothing here is faked.

No GitHub account or repository installation needed to test.

Dashboard

Deliberate Lint Error + CVEapp/api/checkout/route.ts, package.json

SQL Injection & Outdated Vulnerable Dependency

Contains an unescaped SQL query string concatenation and an outdated axios (0.19.0) vulnerable to Server-Side Request Forgery (SSRF).

PR Title: feat: add user checkout endpoint and update network dependencies

Async Lint Warninglib/auth/session.ts

Unhandled Promise Rejection & Missing Error Handling

Contains raw async fetch without try/catch error boundaries and unsafe cookie token assignment.

PR Title: fix: refresh session token and sync profile data

Fixture Code Diff: app/api/checkout/route.ts, package.json

--- a/app/api/checkout/route.ts
+++ b/app/api/checkout/route.ts
@@ -34,6 +34,8 @@ export async function POST(req: Request) {
+  const { userId } = await req.json();
+  // UNSAFE DIRECT QUERY CONCATENATION (SQL INJECTION RISK)
+  const user = await db.raw("SELECT * FROM users WHERE id = '" + userId + "'");
+  await fetch('http://payment-gateway.internal/charge');

--- a/package.json
+++ b/package.json
@@ -12,3 +12,4 @@
+    "axios": "0.19.0",
+    "lodash": "4.17.15"

Your Past Test Runs

No test runs recorded in this session yet

Run a sample file or paste custom code above. Your test runs and shareable links will be saved here automatically!