What an event proves, and what it covers

[eyal-gabay]

You will check our claims, and you should. Here is what stands behind an event and what it covers, in one place.

What an event proves. Untrusted data, from a source you switched on, really reached a dangerous operation in your running program. The event carries the value at both ends and the call path.

What it does not prove. That the flow is exploitable. An allow-list check or an equality test earlier in your code can make it harmless. You judge it.

What stays silent. A correctly parameterized query: the check is on the statement text, never on a bound parameter. A value the product recognizes as made safe for that operation is suppressed, and you can still see it under Suppressed events.

Scope.

• It sees the paths your program actually ran. Code that did not run produced nothing.
• Flaws with no data flow, such as a missing authorization check or CSRF, are outside what it sees.
• You choose what it watches, and the CPU cost scales with each source you switch on. It varies by workload, so measure it on yours.
• Blocking (Raise) is opt-in, enabled per account. At a small number of operations that cannot be interrupted part-way, the error is raised immediately after the operation rather than before it.
• If your own copy of a watched library is the one that imports, that library is not watched for the run, and the machine tells EyalSec so. See Coverage gaps.
• Runs on Linux, x86_64 and aarch64, Python 3.9, 3.10, 3.11, 3.12, 3.13 and 3.14.

Keep your static analysis, WAF and dependency scanner; each does its own job, and es-python adds the view from inside the running program.

Which of these matters most for your workload?