It looks like eval is a special case in our PHP parsing:

$ echo 'eval("echo foo");' | python -m semgrep --lang php --pattern 'evaz(...);' -
ran 1 rules on 1 files: 0 findings

$ echo 'eval("echo foo");' | python -m semgrep --lang php --pattern 'eval(...);' -
semgrep error: invalid pattern
  --> CLI Input:1
1 | eval(...);
  | ^^^^^^^^^

Pattern could not be parsed as a 

It will be a fun exercise to make scan work for mono repos such as https://github.com/swapnil-linux/spring-boot-examples

In theory, this can be achieved using a bit of bash with the new scan AppImage.

What would you like to be added:
Add link of file with vulnerability when print output in terminal

File to edit
https://github.com/ZupIT/horusec/blob/master/horusec-cli/internal/controllers/printresults/print_results.go#L241

Scan the docker network for open ports and vulnerable services.