All demosSemantic Linter

Semantic Linter

Spot potential injections and secrets in sample code.

Performance & cost

This session

Ready to run

Delivery time · median: —
Live model compute: —
Live input tokens: 0
Est. cost · USD: $0.00

Use my key for every request

Bypass examples to measure live inference. Uses your quota.

Measurement details · 0 successful requests

Successful requests: 0

Model compute is the average per measured request. Delivery time is the median browser time for successful requests, including queue, network, and retries. Cached delivery speed is not inference speed. Model compute can exceed browser time when one request processes many inputs.

Tokens come from response headers. Inference costs use $0.04 per million input tokens, before plan credits. The estimate includes live and recorded tokens at the same rate; cached examples are not charged again. Missing usage is unavailable or a partial total (≥). Demo resets keep these totals; reload to start a new session.

Try it

Pick a file and hit Scan file.

Build with the SDKTypeScript · Python · dm1

One request from this demo. Copy it into your app.

Uses your MS_API_KEY and quota. Keep the key on your server.

API request

Install · set your key

npm install @cloudraker/milliseconds
export MS_API_KEY="your-api-key"

example.ts

import { DecisionMachine } from "@cloudraker/milliseconds";

// Run on your server; reads MS_API_KEY from the environment.
const dm = new DecisionMachine();

const { result, usage } = await dm.yesNo(
  [
    "typescript: id: string;",
    "typescript: userId: string;",
    "typescript: items: { sku: string; qty: number; priceCents: number }[];",
    "typescript: couponCode?: string;",
    "typescript: let total = 0;",
    "typescript: for (const item of order.items) total += item.qty * item.priceCents;",
    "typescript: return total;",
    "typescript: if (items.length === 0) return undefined;",
    "typescript: return items[items.length];",
    "typescript: const users = new Map<string, unknown>();",
    "typescript: for (const order of orders) {",
    "typescript: const user = await db.query(\"SELECT * FROM users WHERE id = '\" + order.userId + \"'\");",
    "typescript: users.set(order.userId, user);",
    "typescript: return users;",
    "typescript: const hasCoupon = code === undefined;",
    "typescript: if (hasCoupon) return total;",
    "typescript: if (code === \"HALF\") return Math.round(total / 2);",
    "typescript: return total;",
    "typescript: const secret = \"sk_live_9f8a7b6c5d4e3f2a1b0c\";",
    "typescript: return createHash(\"sha256\").update(order.id + secret).digest(\"hex\");",
    "typescript: const seen: string[] = [];",
    "typescript: const dupes: string[] = [];",
    "typescript: for (const order of orders) {",
    "typescript: for (const item of order.items) {",
    "typescript: if (seen.includes(item.sku)) dupes.push(item.sku);",
    "typescript: seen.push(item.sku);",
    "typescript: return dupes;",
    "typescript: const total = orderTotal(order);",
    "typescript: return `Order ${order.id}: ${order.items.length} items, ${(total / 100).toFixed(2)}`;",
    "typescript: console.log(\"described\", order.id);",
    "typescript: const total = orderTotal(order);",
    "typescript: if (total = 5000) return true;"
  ],
  "This code puts a value that came from outside into a SQL query, a shell command or a file path by building a string.",
  {
    "when_true": "The outside value is glued into the text with +, ||, an f-string, format! or Sprintf, so it becomes part of the query, command or path that runs.",
    "when_false": "The outside value is handed over separately, as a bound parameter written ?, %s or $1, or as its own entry in an argument list, so it never becomes part of the text."
  }
).withUsage();

console.log(result);
console.log({ inputTokens: usage.inputTokens, modelMs: usage.inferenceMs });

example.ts

import { DecisionMachine } from "@cloudraker/milliseconds";

// Run on your server; reads MS_API_KEY from the environment.
const dm = new DecisionMachine();

const { result, usage } = await dm.classify(
  [
    "typescript: id: string;",
    "typescript: userId: string;",
    "typescript: items: { sku: string; qty: number; priceCents: number }[];",
    "typescript: couponCode?: string;",
    "typescript: let total = 0;",
    "typescript: for (const item of order.items) total += item.qty * item.priceCents;",
    "typescript: return total;",
    "typescript: if (items.length === 0) return undefined;",
    "typescript: return items[items.length];",
    "typescript: const users = new Map<string, unknown>();",
    "typescript: for (const order of orders) {",
    "typescript: const user = await db.query(\"SELECT * FROM users WHERE id = '\" + order.userId + \"'\");",
    "typescript: users.set(order.userId, user);",
    "typescript: return users;",
    "typescript: const hasCoupon = code === undefined;",
    "typescript: if (hasCoupon) return total;",
    "typescript: if (code === \"HALF\") return Math.round(total / 2);",
    "typescript: return total;",
    "typescript: const secret = \"sk_live_9f8a7b6c5d4e3f2a1b0c\";",
    "typescript: return createHash(\"sha256\").update(order.id + secret).digest(\"hex\");",
    "typescript: const seen: string[] = [];",
    "typescript: const dupes: string[] = [];",
    "typescript: for (const order of orders) {",
    "typescript: for (const item of order.items) {",
    "typescript: if (seen.includes(item.sku)) dupes.push(item.sku);",
    "typescript: seen.push(item.sku);",
    "typescript: return dupes;",
    "typescript: const total = orderTotal(order);",
    "typescript: return `Order ${order.id}: ${order.items.length} items, ${(total / 100).toFixed(2)}`;",
    "typescript: console.log(\"described\", order.id);",
    "typescript: const total = orderTotal(order);",
    "typescript: if (total = 5000) return true;"
  ],
  {
    "ignore": "Nothing is wrong with this code.",
    "info": "Minor or stylistic concern; the behaviour is correct.",
    "warning": "A risk or smell that should be fixed but does not by itself break the program.",
    "error": "A definite security hole or bug that produces wrong or dangerous behaviour."
  }
).withUsage();

console.log(result);
console.log({ inputTokens: usage.inputTokens, modelMs: usage.inferenceMs });

Install · set your key

pip install cloudraker-milliseconds
export MS_API_KEY="your-api-key"

example.py

from milliseconds import DecisionMachine

# Reads MS_API_KEY from the environment.
dm = DecisionMachine()

result = dm.yes_no(
    [
      "typescript: id: string;",
      "typescript: userId: string;",
      "typescript: items: { sku: string; qty: number; priceCents: number }[];",
      "typescript: couponCode?: string;",
      "typescript: let total = 0;",
      "typescript: for (const item of order.items) total += item.qty * item.priceCents;",
      "typescript: return total;",
      "typescript: if (items.length === 0) return undefined;",
      "typescript: return items[items.length];",
      "typescript: const users = new Map<string, unknown>();",
      "typescript: for (const order of orders) {",
      "typescript: const user = await db.query(\"SELECT * FROM users WHERE id = '\" + order.userId + \"'\");",
      "typescript: users.set(order.userId, user);",
      "typescript: return users;",
      "typescript: const hasCoupon = code === undefined;",
      "typescript: if (hasCoupon) return total;",
      "typescript: if (code === \"HALF\") return Math.round(total / 2);",
      "typescript: return total;",
      "typescript: const secret = \"sk_live_9f8a7b6c5d4e3f2a1b0c\";",
      "typescript: return createHash(\"sha256\").update(order.id + secret).digest(\"hex\");",
      "typescript: const seen: string[] = [];",
      "typescript: const dupes: string[] = [];",
      "typescript: for (const order of orders) {",
      "typescript: for (const item of order.items) {",
      "typescript: if (seen.includes(item.sku)) dupes.push(item.sku);",
      "typescript: seen.push(item.sku);",
      "typescript: return dupes;",
      "typescript: const total = orderTotal(order);",
      "typescript: return `Order ${order.id}: ${order.items.length} items, ${(total / 100).toFixed(2)}`;",
      "typescript: console.log(\"described\", order.id);",
      "typescript: const total = orderTotal(order);",
      "typescript: if (total = 5000) return true;"
    ],
    "This code puts a value that came from outside into a SQL query, a shell command or a file path by building a string.",
    when_true="The outside value is glued into the text with +, ||, an f-string, format! or Sprintf, so it becomes part of the query, command or path that runs.",
    when_false="The outside value is handed over separately, as a bound parameter written ?, %s or $1, or as its own entry in an argument list, so it never becomes part of the text."
)

print(result)

example.py

from milliseconds import DecisionMachine

# Reads MS_API_KEY from the environment.
dm = DecisionMachine()

result = dm.classify(
    [
      "typescript: id: string;",
      "typescript: userId: string;",
      "typescript: items: { sku: string; qty: number; priceCents: number }[];",
      "typescript: couponCode?: string;",
      "typescript: let total = 0;",
      "typescript: for (const item of order.items) total += item.qty * item.priceCents;",
      "typescript: return total;",
      "typescript: if (items.length === 0) return undefined;",
      "typescript: return items[items.length];",
      "typescript: const users = new Map<string, unknown>();",
      "typescript: for (const order of orders) {",
      "typescript: const user = await db.query(\"SELECT * FROM users WHERE id = '\" + order.userId + \"'\");",
      "typescript: users.set(order.userId, user);",
      "typescript: return users;",
      "typescript: const hasCoupon = code === undefined;",
      "typescript: if (hasCoupon) return total;",
      "typescript: if (code === \"HALF\") return Math.round(total / 2);",
      "typescript: return total;",
      "typescript: const secret = \"sk_live_9f8a7b6c5d4e3f2a1b0c\";",
      "typescript: return createHash(\"sha256\").update(order.id + secret).digest(\"hex\");",
      "typescript: const seen: string[] = [];",
      "typescript: const dupes: string[] = [];",
      "typescript: for (const order of orders) {",
      "typescript: for (const item of order.items) {",
      "typescript: if (seen.includes(item.sku)) dupes.push(item.sku);",
      "typescript: seen.push(item.sku);",
      "typescript: return dupes;",
      "typescript: const total = orderTotal(order);",
      "typescript: return `Order ${order.id}: ${order.items.length} items, ${(total / 100).toFixed(2)}`;",
      "typescript: console.log(\"described\", order.id);",
      "typescript: const total = orderTotal(order);",
      "typescript: if (total = 5000) return true;"
    ],
    {
      "ignore": "Nothing is wrong with this code.",
      "info": "Minor or stylistic concern; the behaviour is correct.",
      "warning": "A risk or smell that should be fixed but does not by itself break the program.",
      "error": "A definite security hole or bug that produces wrong or dangerous behaviour."
    }
)

print(result)

Install · set your key

npm install -g @cloudraker/milliseconds
export MS_API_KEY="your-api-key"

Terminal

# Reads MS_API_KEY. JSON on stdin supplies the complete request.
dm1 yes-no --json --usage <<'DM1_REQUEST'
{
  "texts": [
    "typescript: id: string;",
    "typescript: userId: string;",
    "typescript: items: { sku: string; qty: number; priceCents: number }[];",
    "typescript: couponCode?: string;",
    "typescript: let total = 0;",
    "typescript: for (const item of order.items) total += item.qty * item.priceCents;",
    "typescript: return total;",
    "typescript: if (items.length === 0) return undefined;",
    "typescript: return items[items.length];",
    "typescript: const users = new Map<string, unknown>();",
    "typescript: for (const order of orders) {",
    "typescript: const user = await db.query(\"SELECT * FROM users WHERE id = '\" + order.userId + \"'\");",
    "typescript: users.set(order.userId, user);",
    "typescript: return users;",
    "typescript: const hasCoupon = code === undefined;",
    "typescript: if (hasCoupon) return total;",
    "typescript: if (code === \"HALF\") return Math.round(total / 2);",
    "typescript: return total;",
    "typescript: const secret = \"sk_live_9f8a7b6c5d4e3f2a1b0c\";",
    "typescript: return createHash(\"sha256\").update(order.id + secret).digest(\"hex\");",
    "typescript: const seen: string[] = [];",
    "typescript: const dupes: string[] = [];",
    "typescript: for (const order of orders) {",
    "typescript: for (const item of order.items) {",
    "typescript: if (seen.includes(item.sku)) dupes.push(item.sku);",
    "typescript: seen.push(item.sku);",
    "typescript: return dupes;",
    "typescript: const total = orderTotal(order);",
    "typescript: return `Order ${order.id}: ${order.items.length} items, ${(total / 100).toFixed(2)}`;",
    "typescript: console.log(\"described\", order.id);",
    "typescript: const total = orderTotal(order);",
    "typescript: if (total = 5000) return true;"
  ],
  "statement": "This code puts a value that came from outside into a SQL query, a shell command or a file path by building a string.",
  "when_true": "The outside value is glued into the text with +, ||, an f-string, format! or Sprintf, so it becomes part of the query, command or path that runs.",
  "when_false": "The outside value is handed over separately, as a bound parameter written ?, %s or $1, or as its own entry in an argument list, so it never becomes part of the text."
}
DM1_REQUEST

Terminal

# Reads MS_API_KEY. JSON on stdin supplies the complete request.
dm1 classify --json --usage <<'DM1_REQUEST'
{
  "texts": [
    "typescript: id: string;",
    "typescript: userId: string;",
    "typescript: items: { sku: string; qty: number; priceCents: number }[];",
    "typescript: couponCode?: string;",
    "typescript: let total = 0;",
    "typescript: for (const item of order.items) total += item.qty * item.priceCents;",
    "typescript: return total;",
    "typescript: if (items.length === 0) return undefined;",
    "typescript: return items[items.length];",
    "typescript: const users = new Map<string, unknown>();",
    "typescript: for (const order of orders) {",
    "typescript: const user = await db.query(\"SELECT * FROM users WHERE id = '\" + order.userId + \"'\");",
    "typescript: users.set(order.userId, user);",
    "typescript: return users;",
    "typescript: const hasCoupon = code === undefined;",
    "typescript: if (hasCoupon) return total;",
    "typescript: if (code === \"HALF\") return Math.round(total / 2);",
    "typescript: return total;",
    "typescript: const secret = \"sk_live_9f8a7b6c5d4e3f2a1b0c\";",
    "typescript: return createHash(\"sha256\").update(order.id + secret).digest(\"hex\");",
    "typescript: const seen: string[] = [];",
    "typescript: const dupes: string[] = [];",
    "typescript: for (const order of orders) {",
    "typescript: for (const item of order.items) {",
    "typescript: if (seen.includes(item.sku)) dupes.push(item.sku);",
    "typescript: seen.push(item.sku);",
    "typescript: return dupes;",
    "typescript: const total = orderTotal(order);",
    "typescript: return `Order ${order.id}: ${order.items.length} items, ${(total / 100).toFixed(2)}`;",
    "typescript: console.log(\"described\", order.id);",
    "typescript: const total = orderTotal(order);",
    "typescript: if (total = 5000) return true;"
  ],
  "labels": {
    "ignore": "Nothing is wrong with this code.",
    "info": "Minor or stylistic concern; the behaviour is correct.",
    "warning": "A risk or smell that should be fixed but does not by itself break the program.",
    "error": "A definite security hole or bug that produces wrong or dangerous behaviour."
  }
}
DM1_REQUEST

Under the hood How it works & limitations

API calls/yes-no/classify

How it works

The model judges code lines in batches. Local syntax checks narrow the findings to supported patterns, and the editor marks lines that clear the reporting threshold. Auto-lint can check edits as you type.

Demo scope

This demo has a narrow scope: injections and hardcoded secrets. It does not detect logic, null-handling, error-handling or performance defects. Scores can vary with batch contents; review each finding.

Inspired by the work of dabit3.