Security holes in agent-written code, class by class.

• SQL injection in agent-written codeQuery placeholders can hold a value but not a column name, so the sort and filter features agents are asked to add are where raw strings come back.Read the class
• Command injection in agent-written codeAgents work in a terminal all day, so when a feature needs a command-line tool, the first draft is often the exact string they would type, handed to a shell.Read the class
• Cross-site scripting in agent-written codeModern frameworks escape text for you. The cross-site scripting that ships now comes through the escape hatch an agent opens when asked to render formatting.Read the class
• SSRF in agent-written codeAny feature that fetches a URL a user typed makes your server the one knocking on the door, and your server can reach doors the user cannot.Read the class
• Path traversal in agent-written codeJoining a folder and a filename looks like it keeps the file inside the folder. With two dots in the filename, it does not.Read the class
• Unsafe deserialization in agent-written codeSome save formats are not data but instructions for rebuilding an object, and the instructions can say "run this command first".Read the class
• Token and session flaws in agent-written codeA login token is only worth something if the server checks who signed it. The function that reads a token without checking is one word away from the one that checks.Read the class

Access control and LLM integration have their own guides.

Aevral started with access control, so those classes already have longer walkthroughs. They are not repeated here.

• IDOR in multi-tenant codeThe caller names a record id and the query forgets to check it belongs to them.
• Reviewing a pull request for access controlThe gate that moved or disappeared: who may do what, read from the diff.
• Where access control hides in business logicPlan gates, entitlements and roles matched by label instead of by rule.
• Reviewing a pull request that wires in an LLMUntrusted text in the prompt, model output trusted downstream.

What these pages do not claim

Aevral's PR security review, live on install, looks for these classes on the pull requests it reviews; looking for a class does not mean finding each instance of it. The whole-repo scan reads authorization, IDOR, and business-logic access control only. The diffs on these pages are illustrations, and the receipts are named runs of the whole eval suite. Where they mention a class, it is a small-corpus observation, not a performance estimate for that class.