Use of exec()/eval() in Python
Part of Security, which counts for 30% of the overall score. When this check fires it deducts 15 points from that category, once per scan, no matter how many places it turns up.
What it detects
exec()/eval() run arbitrary code and are rarely required outside of very specific tooling.
Why it matters
exec() and eval() execute arbitrary Python, so any user or file input reaching them becomes code running with your app's permissions. Real needs for them are rare outside REPLs and code generators. Most uses in application code are shortcuts that have a safe equivalent.
How to fix it
Use ast.literal_eval for parsing literal values, json.loads for data, getattr or a dict dispatch for dynamic calls, and importlib.import_module for dynamic imports. If a script genuinely needs exec (for example a plugin loader you control), restrict its input strictly to files you ship, never network or user input.
The paid report includes a ready-to-paste prompt for your AI coding agent for every check it finds, pointed at the exact findings from your scan. See pricing
Does your repo trip this check?
Paste a GitHub URL or drop a project folder. Scans run in your browser and take seconds.
Scan your repo