SpringOwlCase Studies
Demonstration analyses using synthetic companies. This is what Talon finds.
| Company | Risk Score | Code Findings | CVEs | Critical (EPSS>0.5) | Verdict |
|---|---|---|---|---|---|
| Company A | 60/100 | 4 | 16 | 1 | Pass |
| Company B | 0/100 | 0 | 0 | 0 | Proceed to diligence |
| Self-Audit | 0/100 | 0 | 23 | 1 | Proceed with dep review |
Company A: Seed-Stage API Platform
Submission: FastAPI backend, 10 Python dependencies, ~65 lines
Code Findings (Semgrep)
text() query. User input directly interpolated into SQL.
subprocess.run(cmd, shell=True) with user-controlled input. Remote code execution possible.
pickle.loads(data) on untrusted input. Arbitrary code execution via crafted payload.
requests.get(url) with user-controlled URL. Server-side request forgery to internal services.
Critical CVE
cryptography==3.4.8 — X.400 address type confusion in X.509 certificate verification. 89% probability of active exploitation. 99.5th percentile.
Additionally: 4 hardcoded secrets found (database password, JWT key, AWS access key, AWS secret key). No authentication on admin command execution endpoint.
Company B: Seed-Stage API Platform (Same Product, Rebuilt)
Submission: Async FastAPI backend, 9 Python dependencies, ~147 lines
What Changed
- SQL queries parameterized via SQLAlchemy
select()— no string interpolation - Secrets loaded from environment variables via
pydantic-settings - Authentication on all endpoints (OAuth2 + JWT with bcrypt hashing)
- CORS locked to specific allowed origins
- All dependencies at current versions — zero known CVEs
- Async throughout (FastAPI + SQLAlchemy async engine)
- Tests included (auth + health endpoint coverage)
Self-Audit: Talon Analyzing Talon
Submission: The OpenClaw codebase itself — 38 dependencies, ~2,100 lines
What Talon Found in Itself
Code quality: clean. Zero Semgrep findings. Zero regex pattern matches. The application code has no hardcoded secrets, no injection vulnerabilities, no unsafe deserialization.
Supply chain: 23 CVEs in the dependency tree. This is normal for a Python project with 38 transitive dependencies. Most are low-severity or theoretical. However:
This demonstrates a key insight: even well-written code has supply chain risk. Talon catches what manual code review misses — the vulnerabilities hiding in your dependencies, weighted by actual exploit probability.
What This Proves
- Signal over noise. Company A has 16 CVEs but only 1 is critical (EPSS 0.89). Without EPSS scoring, all 16 look equally scary. With it, the operator knows exactly where to focus.
- Code quality is not binary. Company B and the Self-Audit both score 0 on code findings, but the Self-Audit has supply chain risk. The combination of Semgrep + CVE + EPSS gives a complete picture.
- Speed. Each analysis completes in under 60 seconds on GPU. A traditional manual audit of Company A would take 2-3 days.
- We eat our own cooking. Talon runs on itself. We publish the results. If we can't pass our own tool, we have no business evaluating anyone else.
Submit your company | Learn about Talon | Security architecture
SpringOwl Asset Management | February 2026
Analysis performed by Talon v0.3.0. All CVE data from OSV.dev. EPSS scores from FIRST.org. Static analysis by Semgrep.