Will It Vibe?extract() called on request input
Part of Security, which counts for 30% of the overall score. When this check fires it deducts 15 points from that category, once per scan, no matter how many places it turns up.
What it detects
extract() creates a local variable for every key in the array, so extract($_GET) or extract($_POST) lets a request define or overwrite any variable in the current scope, including ones the code trusts implicitly.
Why it matters
extract($_GET) or extract($_POST) creates a variable for every key the request sent, so a request can define or silently overwrite variables the rest of the function assumes are safe, including ones never meant to be attacker-controlled, like a role or admin flag used later in the same scope. This is exactly the bug class PHP's old register_globals setting caused, recreated deliberately.
How to fix it
Read only the specific keys the code actually needs, with an explicit default, for example $name = $_POST['name'] ?? null;. If many keys are needed, loop over an explicit allowlist of expected names instead of extracting everything. Never call extract() on any request superglobal.
The paid report includes a ready-to-paste prompt for your AI coding agent for every check it finds, pointed at the exact findings from your scan. See pricing
Does your repo trip this check?
Paste a GitHub URL or drop a project folder. Scans run in your browser and take seconds.
Scan your repo