Skip to content
ExfilPath

Analyzer

Add your agent code. See every path in seconds.

46 detectors · TypeScript, JavaScript and Python · your agent is never executed.

Example report

What you get back.

Generated by the engine from the email-triage example agent, which is modeled on the EchoLeak chain. Sign in to run the same analysis on your own code.

exfilpath.tech/reports/email-triage-agent

Overview

20ms · static analysis, nothing executed

Export report

Open paths

22 critical

Exposure

96/100 · grade F

Closed by controls

00 controls found

Files analyzed

473 lines

critical

Inbound email reaches network egress

82%

Source

Inbound email

Model

OpenAI call

No guard on the value

Action

HTTP request

critical

Inbound email reaches auto-fetched render

72%
Suggested fixone-line

Pin the destination to an allowlist

+const ALLOWED_HOSTS = new Set(['hooks.example.com']);
+if (!ALLOWED_HOSTS.has(url.hostname)) throw blocked;
-await fetch(link, { method: "POST", body });
+await safeFetch(link, { method: "POST", body });

Closes this path on re-scan

How to read a report

An open path reaches a sensitive action with nothing covering it. A closed path already has a control in the way. Confidence tells you how direct the route is.

The full method

Bring the whole repository

Folder selection skips dependencies and build output, and routes are traced across files rather than judged one file at a time.

Documentation

What happens to your code

Your source is read in your own browser session, never executed, and no model provider is involved at any point.

Security and privacy