What's the difference between this and SQL injection?

This is broader: unvalidated request data reaching any dangerous sink (DB writes, shell commands), not just SQL query strings.

How is a 'sink' detected?

A code scan traces request-originated values into database writes and shell-exec calls and flags paths that reach the sink without a validation step.

Validate and schema-check all request data at the boundary before it reaches any write or shell sink, and never pass raw input to exec().

C19

Input handling

Unvalidated Input Check — Does Request Data Flow Straight Into Writes or Shell?

DevMeth checks the 48 known AI-code failure patterns — not a penetration test or a security guarantee.

What the issue is

When request data flows straight into a database write or a shell command without validation, a crafted value can corrupt data or run unintended commands on your server.

Why AI tools generate it

AI tools often pass request values directly into a write or exec() to save a step, skipping the schema check that would catch hostile shapes.

How DevMeth detects it

A code scan traces request-originated data into database writes or shell sinks and flags any path that reaches the sink unvalidated.

C19

What a finding looks like

High

Request data flows straight into database writes or shell commands unvalidated

WHAT WE FOUND

src/admin.ts — exec(body.command) — unvalidated

Sample — illustrative and masked exactly as a real report shows it. Run a free scan to see your own results.

The fix, in three steps

Validate and schema-check request data before it reaches any DB-write or shell sink, and never feed raw input to exec(). Three steps.

Run a free scan and each finding carries a paste-ready fix prompt you can act on.

Try a free scan

FAQ

DevMeth checks the 48 known AI-code failure patterns — not a penetration test or a security guarantee. A clear result means each known pattern was checked and found clear or not applicable for your app; it is not a guarantee of security.